@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/design/__tests__/share-access.test.ts

@@ -0,0 +1,128 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/**
+ * 分享访问凭证（审计 2026-10-25 🔴：分享密码门仅存在于前端，数据面 RPC 直连可绕过）。
+ * 覆盖：token 往返 / 过期 / 篡改 / 跨 share 不互认 / 密钥缺失显式失败 / 门禁判定。
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  cookies: new Map<string, string>(),
+  cookieContextBroken: false,
+}))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getCookie: (name: string) => {
+    if (mocks.cookieContextBroken) throw new Error('no request context')
+    return mocks.cookies.get(name)
+  },
+  setCookie: (name: string, value: string) => {
+    mocks.cookies.set(name, value)
+  },
+}))
+
+import {
+  createShareAccessToken,
+  hasShareAccess,
+  issueShareAccess,
+  SHARE_ACCESS_TTL_SECONDS,
+  shareAccessCookieName,
+  shareGatePassed,
+  verifyShareAccessToken,
+} from '../share-access'
+
+beforeEach(() => {
+  vi.stubEnv('AUTH_SECRET', 'unit-test-secret')
+  vi.stubEnv('SHARE_ACCESS_SECRET', '')
+  mocks.cookies.clear()
+  mocks.cookieContextBroken = false
+})
+
+afterEach(() => {
+  vi.unstubAllEnvs()
+})
+
+describe('token 签发与校验', () => {
+  it('同 shareId 往返校验通过', () => {
+    const token = createShareAccessToken('s1')
+    expect(verifyShareAccessToken('s1', token)).toBe(true)
+  })
+
+  it('换一个 shareId 不互认', () => {
+    const token = createShareAccessToken('s1')
+    expect(verifyShareAccessToken('s2', token)).toBe(false)
+  })
+
+  it('过期后拒绝', () => {
+    const issuedAt = Date.UTC(2026, 0, 1)
+    const token = createShareAccessToken('s1', issuedAt)
+    const afterExpiry = issuedAt + (SHARE_ACCESS_TTL_SECONDS + 1) * 1000
+    expect(verifyShareAccessToken('s1', token, afterExpiry)).toBe(false)
+    expect(verifyShareAccessToken('s1', token, issuedAt + 1000)).toBe(true)
+  })
+
+  it('篡改 exp 或签名任一位即拒绝', () => {
+    const token = createShareAccessToken('s1')
+    const [exp, sig] = token.split('.')
+    expect(verifyShareAccessToken('s1', `${Number(exp) + 10}.${sig}`)).toBe(false)
+    const flipped = sig.endsWith('A') ? `${sig.slice(0, -1)}B` : `${sig.slice(0, -1)}A`
+    expect(verifyShareAccessToken('s1', `${exp}.${flipped}`)).toBe(false)
+  })
+
+  it('畸形输入一律拒绝', () => {
+    expect(verifyShareAccessToken('s1', undefined)).toBe(false)
+    expect(verifyShareAccessToken('s1', '')).toBe(false)
+    expect(verifyShareAccessToken('s1', 'no-dot')).toBe(false)
+    expect(verifyShareAccessToken('s1', '.sig')).toBe(false)
+    expect(verifyShareAccessToken('s1', 'abc.sig')).toBe(false)
+  })
+
+  it('密钥缺失时显式抛错（禁止回退公开常量）', () => {
+    vi.stubEnv('AUTH_SECRET', '')
+    expect(() => createShareAccessToken('s1')).toThrow(/AUTH_SECRET/)
+  })
+
+  it('换密钥后旧 token 失效', () => {
+    const token = createShareAccessToken('s1')
+    vi.stubEnv('AUTH_SECRET', 'rotated')
+    expect(verifyShareAccessToken('s1', token)).toBe(false)
+  })
+})
+
+describe('cookie 面与门禁', () => {
+  it('issueShareAccess 写入 httpOnly cookie，hasShareAccess 据此放行', () => {
+    expect(hasShareAccess('s1')).toBe(false)
+    issueShareAccess('s1')
+    expect(mocks.cookies.has(shareAccessCookieName('s1'))).toBe(true)
+    expect(hasShareAccess('s1')).toBe(true)
+    expect(hasShareAccess('s2')).toBe(false)
+  })
+
+  it('无请求上下文（getCookie 抛错）视为无凭证', () => {
+    issueShareAccess('s1')
+    mocks.cookieContextBroken = true
+    expect(hasShareAccess('s1')).toBe(false)
+  })
+
+  it('shareGatePassed：无密码分享直接放行；有密码须持凭证', () => {
+    expect(shareGatePassed({ id: 'open', hasPassword: false })).toBe(true)
+    expect(shareGatePassed({ id: 'locked', hasPassword: true })).toBe(false)
+    issueShareAccess('locked')
+    expect(shareGatePassed({ id: 'locked', hasPassword: true })).toBe(true)
+  })
+})

package/src/server/design/access.ts

@@ -0,0 +1,136 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 设计域资源归属守卫（仅服务端；serverFn 纯净纪律要求守卫逻辑独立于 createServerFn 文件）。
+//
+// Design 为单属主模型（Design.userId），无成员表：写路径一律要求属主；读路径对属主放行，
+// 对分享访客按 share-access 门禁放行（ACTIVE 且未过期的分享，有密码者须持凭证）。
+// 页面 / 页面版本 / 设计版本的归属均经关系链反查到 design.userId，禁止裸 id 直操作。
+
+import { getPrisma } from '@allbluecn/database/get-prisma'
+import { verifyDesignOwner } from '@allbluecn/database/lib/share-utils'
+import type { HostSession } from '@allbluecn/kernel'
+import { shareGatePassed } from './share-access'
+
+export const DESIGN_FORBIDDEN_MESSAGE = '无权限'
+
+/** requireAuth 已保证登录，但 HostSession.user.id 类型上可选；统一在此收窄，杜绝 `!` 断言 */
+export function sessionUserId(session: HostSession | null | undefined): string {
+  const id = session?.user?.id
+  if (!id) throw new Error('UNAUTHORIZED')
+  return id
+}
+
+export async function isDesignOwner(designId: string, userId: string): Promise<boolean> {
+  return verifyDesignOwner(designId, userId)
+}
+
+export async function assertDesignOwner(designId: string, userId: string): Promise<void> {
+  if (!(await isDesignOwner(designId, userId))) {
+    throw new Error(DESIGN_FORBIDDEN_MESSAGE)
+  }
+}
+
+/** 页面归属：经 page.design.userId 反查；返回 designId 供同库一致性校验 */
+export async function assertPageOwner(pageId: string, userId: string): Promise<{ designId: string }> {
+  const prisma = await getPrisma()
+  const page = await prisma.designPage.findUnique({
+    where: { id: pageId },
+    select: { designId: true, design: { select: { userId: true } } },
+  })
+  if (!page || page.design.userId !== userId) {
+    throw new Error(DESIGN_FORBIDDEN_MESSAGE)
+  }
+  return { designId: page.designId }
+}
+
+export async function assertPageVersionOwner(
+  pageVersionId: string,
+  userId: string,
+): Promise<{ pageId: string; designId: string }> {
+  const prisma = await getPrisma()
+  const pageVersion = await prisma.pageVersion.findUnique({
+    where: { id: pageVersionId },
+    select: {
+      pageId: true,
+      page: { select: { designId: true, design: { select: { userId: true } } } },
+    },
+  })
+  if (!pageVersion || pageVersion.page.design.userId !== userId) {
+    throw new Error(DESIGN_FORBIDDEN_MESSAGE)
+  }
+  return { pageId: pageVersion.pageId, designId: pageVersion.page.designId }
+}
+
+/**
+ * 分享访客可见性：design 存在任一 ACTIVE 且未过期的分享并通过密码门禁即可见。
+ * 供评论等「随分享页公开」的只读/受限写路径使用；版本内容面另按 versionId 精确反查。
+ */
+export async function canViewSharedDesign(designId: string): Promise<boolean> {
+  const prisma = await getPrisma()
+  const shares = await prisma.share.findMany({
+    where: {
+      designId,
+      status: 'ACTIVE',
+      OR: [{ expiresAt: null }, { expiresAt: { gt: new Date() } }],
+    },
+    select: { id: true, hasPassword: true },
+  })
+  return shares.some((share) => shareGatePassed(share))
+}
+
+/** 属主或分享访客可读；均不满足抛「无权限」。返回 isOwner 供调用方裁剪敏感字段 */
+export async function assertDesignReadable(
+  designId: string,
+  userId: string | null | undefined,
+): Promise<{ isOwner: boolean }> {
+  if (userId && (await isDesignOwner(designId, userId))) {
+    return { isOwner: true }
+  }
+  if (await canViewSharedDesign(designId)) {
+    return { isOwner: false }
+  }
+  throw new Error(DESIGN_FORBIDDEN_MESSAGE)
+}
+
+/**
+ * 分享数据面可见版本过滤：版本须经 ShareVersion 关联到该 design 下至少一个 ACTIVE 且未过期
+ * 的分享（prd / prd_single 均可），且该分享通过密码门禁。与 getVersionShareFn 的 SEC-18 口径一致。
+ */
+export async function resolveAccessibleVersionIds(
+  designId: string,
+  versionIds: string[],
+): Promise<string[]> {
+  if (versionIds.length === 0) return []
+  const prisma = await getPrisma()
+  const rows = await prisma.shareVersion.findMany({
+    where: {
+      versionId: { in: versionIds },
+      share: {
+        designId,
+        status: 'ACTIVE',
+        OR: [{ expiresAt: null }, { expiresAt: { gt: new Date() } }],
+      },
+    },
+    select: { versionId: true, share: { select: { id: true, hasPassword: true } } },
+  })
+  const accessible = new Set<string>()
+  for (const row of rows) {
+    if (shareGatePassed(row.share)) accessible.add(row.versionId)
+  }
+  return versionIds.filter((id) => accessible.has(id))
+}

package/src/server/design/annotation-prompt.ts

@@ -16,6 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { resolveSystemPrompt } from "@/server/ai-gateway"
+import { fenceLlmData } from "@/server/ai-gateway/llm-fence"
 
 /**
  * buildFillPrompt 的入参形状。
@@ -57,5 +58,10 @@ export async function buildFillPrompt(info: FillComponentInfo): Promise<string[]
 ${propList}
 ${templateSection}`
 
-  return resolveSystemPrompt("design.fill-annotation", { componentInfo })
+  // 组件名/注释模板/属性标签源自设计文档数据（最终用户可写），与
+  // repro-runner 全量围栏口径一致——套 fenceLlmData 防指令注入
+  // （审计 🟡：恶意模板可携带覆盖 system prompt 意图的指令）
+  return resolveSystemPrompt("design.fill-annotation", {
+    componentInfo: fenceLlmData("设计组件信息", componentInfo),
+  })
 }

package/src/server/design/share-access.ts

@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 分享密码门禁凭证（仅服务端，禁止客户端 import）。
+//
+// 分享密码此前只存在于前端交互层：verifySharePasswordFn 返回 valid 后客户端把明文
+// 密码放进 sessionStorage 即放行，而 getShareVersionsFn / getShareVersionDataFn /
+// getVersionShareFn 等数据面 serverFn 不做任何校验，知道 designId 即可 RPC 直连拉取
+// 全量 canvas/content（审计 2026-10-25 🔴）。
+//
+// 修复口径：verify 成功后服务端签发 httpOnly HMAC cookie（按 shareId 绑定、短时效），
+// 数据面以 shareGatePassed() 统一放行判定——无密码分享照常公开；有密码分享必须持有
+// 该 share 的有效凭证。凭证不落库、不含密码，签名密钥缺失时显式失败（禁止回退公开常量）。
+
+import { createHmac, timingSafeEqual } from 'node:crypto'
+import { getCookie, setCookie } from '@tanstack/react-start/server'
+
+const COOKIE_PREFIX = 'share_access_'
+/** 凭证有效期：覆盖一次完整的分享浏览会话；过期后重新输入密码即可续签 */
+export const SHARE_ACCESS_TTL_SECONDS = 12 * 60 * 60
+
+function getSigningSecret(): string {
+  const secret = process.env.SHARE_ACCESS_SECRET || process.env.AUTH_SECRET
+  if (!secret) {
+    throw new Error('缺少 AUTH_SECRET：无法签发/校验分享访问凭证')
+  }
+  return secret
+}
+
+function sign(shareId: string, exp: number): string {
+  return createHmac('sha256', getSigningSecret())
+    .update(`share-access:${shareId}:${exp}`)
+    .digest('base64url')
+}
+
+export function shareAccessCookieName(shareId: string): string {
+  return `${COOKIE_PREFIX}${shareId}`
+}
+
+/** 生成凭证字符串（`<exp>.<sig>`），独立于请求上下文以便单测 */
+export function createShareAccessToken(shareId: string, now: number = Date.now()): string {
+  const exp = Math.floor(now / 1000) + SHARE_ACCESS_TTL_SECONDS
+  return `${exp}.${sign(shareId, exp)}`
+}
+
+export function verifyShareAccessToken(
+  shareId: string,
+  token: string | undefined | null,
+  now: number = Date.now(),
+): boolean {
+  if (!token) return false
+  const dot = token.indexOf('.')
+  if (dot <= 0) return false
+  const exp = Number(token.slice(0, dot))
+  const sig = token.slice(dot + 1)
+  if (!Number.isInteger(exp) || exp <= Math.floor(now / 1000) || !sig) return false
+  const expected = Buffer.from(sign(shareId, exp))
+  const actual = Buffer.from(sig)
+  return actual.length === expected.length && timingSafeEqual(actual, expected)
+}
+
+/** verify 成功后调用：向当前响应写入该 share 的访问凭证 cookie */
+export function issueShareAccess(shareId: string): void {
+  setCookie(shareAccessCookieName(shareId), createShareAccessToken(shareId), {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: process.env.NODE_ENV === 'production',
+    path: '/',
+    maxAge: SHARE_ACCESS_TTL_SECONDS,
+  })
+}
+
+/** 当前请求是否持有该 share 的有效凭证；无请求上下文（服务端内部调用）视为无凭证 */
+export function hasShareAccess(shareId: string): boolean {
+  let raw: string | undefined
+  try {
+    raw = getCookie(shareAccessCookieName(shareId))
+  } catch {
+    return false
+  }
+  return verifyShareAccessToken(shareId, raw)
+}
+
+export interface ShareGateInput {
+  id: string
+  hasPassword: boolean
+}
+
+/**
+ * 分享数据面统一门禁：无密码分享直接放行；有密码分享须持有效凭证。
+ * 以 hasPassword 为权威开关（关闭密码时 password 列保留旧值但 hasPassword=false）。
+ */
+export function shareGatePassed(share: ShareGateInput): boolean {
+  return !share.hasPassword || hasShareAccess(share.id)
+}

package/src/server/design/share-generate.ts

@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 分享 token / 密码生成与过期档位的单一来源（仅服务端；审计 2026-10-25 🔵：
+// shares.ts 与 shares-password.ts 各持一份同值常量，一处改熵另一处漂移）。
+
+import { customAlphabet } from 'nanoid'
+import bcrypt from 'bcryptjs'
+
+const TOKEN_ALPHABET = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'
+export const generateShareToken = customAlphabet(TOKEN_ALPHABET, 24)
+
+const PASSWORD_ALPHABET = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
+// 8 位字母数字（62^8 ≈ 2.2e14）：原 4 位（62^4）经不起离线爆破；门禁输入 4~8 位兼容存量
+export const SHARE_PASSWORD_LENGTH = 8
+export const generateSharePassword = customAlphabet(PASSWORD_ALPHABET, SHARE_PASSWORD_LENGTH)
+
+/** 分享密码 hash-on-write：DB 只存 bcrypt 哈希，明文仅在生成/重置响应中一次性回显属主 */
+export function hashSharePassword(plain: string): Promise<string> {
+  // cost 10：分享门禁密码价值低于登录口令，验证路径（verifySharePasswordFn）热一些
+  return bcrypt.hash(plain, 10)
+}
+
+export const EXPIRY_DAYS: Record<string, number> = {
+  '7': 7,
+  '30': 30,
+  '90': 90,
+}

package/src/server/desktop-guest.ts

@@ -1,3 +1,4 @@
+import { DEFAULT_AI_MODEL, DEFAULT_AI_PROVIDER } from '@/lib/ai/default-model'
 import type { Session } from '@/lib/session'
 
 export const GUEST_USER_ID = 'local-guest'
@@ -16,8 +17,8 @@ export function buildGuestSession(): Session {
       email: GUEST_EMAIL,
       role: 'USER',
       isGuest: true,
-      aiProvider: 'openrouter',
-      aiModel: 'openai/gpt-4o-mini',
+      aiProvider: DEFAULT_AI_PROVIDER,
+      aiModel: DEFAULT_AI_MODEL,
       hasAiKey: false,
     },
     expires: 'never',

package/src/server/email/deliverability.ts

@@ -3,7 +3,15 @@ import { createHmac, timingSafeEqual } from 'crypto'
 const UNSUB_TTL_MS = 10 * 365 * 24 * 60 * 60 * 1000 // 10 年（退订链接长期有效）
 
 function secret(): string {
-  return process.env.AUTH_SECRET ?? 'dev-only-secret'
+  const configured = process.env.AUTH_SECRET
+  if (configured) return configured
+  // 审计 A4x-1 🟡：生产环境缺 AUTH_SECRET 时曾静默回落到公开已知的 'dev-only-secret'，
+  // 任何人可伪造退订凭据；生产/预发直接抛错（与 ticket-utils「缺密钥必须失败」同口径），
+  // 仅开发与测试保留可用兜底
+  if (process.env.NODE_ENV === 'production') {
+    throw new Error('缺少 AUTH_SECRET：退订链接签名不可用（生产环境必须配置）')
+  }
+  return 'dev-only-secret'
 }
 
 export interface UnsubscribePayload {

package/src/server/email/drivers/resend.ts

@@ -6,10 +6,17 @@ interface ResendSendResponse {
 }
 
 export async function sendByResend(msg: EmailMessage): Promise<{ messageId: string | null; bounced: boolean }> {
+  const apiKey = process.env.RESEND_API_KEY
+  if (!apiKey) {
+    // 缺 key 时不再以 `Bearer undefined` 发出后才失败（审计 A4x-1 🟡）
+    throw new Error('缺少 RESEND_API_KEY：无法通过 Resend 发送邮件')
+  }
   const res = await fetch('https://api.resend.com/emails', {
     method: 'POST',
+    // 上游挂起时不让邮件链路无限等待（与 webhook-out 的 5s 超时同惯例）
+    signal: AbortSignal.timeout(10_000),
     headers: {
-      Authorization: `Bearer ${process.env.RESEND_API_KEY}`,
+      Authorization: `Bearer ${apiKey}`,
       'Content-Type': 'application/json',
     },
     body: JSON.stringify({

package/src/server/email/drivers/smtp.ts

@@ -1,27 +1,41 @@
 import nodemailer from 'nodemailer'
 import type { EmailMessage } from '../sender'
 
-export async function sendBySmtp(msg: EmailMessage): Promise<{ messageId: string | null; bounced: boolean }> {
-  const transport = nodemailer.createTransport({
+// 模块级单例（按 env memo）：批量发送复用连接池，避免逐封建连（审计 A4x-1 🟡）
+type SmtpTransport = ReturnType<typeof nodemailer.createTransport>
+let cachedTransport: SmtpTransport | null = null
+let cachedKey = ''
+
+function getTransport(): SmtpTransport {
+  const port = Number(process.env.EMAIL_PORT ?? 587)
+  const key = `${process.env.EMAIL_HOST}|${port}|${process.env.EMAIL_USER ?? ''}`
+  if (cachedTransport && cachedKey === key) return cachedTransport
+  cachedTransport?.close()
+  cachedTransport = nodemailer.createTransport({
     host: process.env.EMAIL_HOST,
-    port: Number(process.env.EMAIL_PORT ?? 587),
-    secure: Number(process.env.EMAIL_PORT) === 465,
+    port,
+    secure: port === 465,
+    // 587 端口强制 STARTTLS：机会式 TLS 在对方不支持时会明文传输凭据与内容
+    requireTLS: port === 587,
     auth: process.env.EMAIL_USER
       ? { user: process.env.EMAIL_USER, pass: process.env.EMAIL_PASS }
       : undefined,
   })
-  try {
-    const info = await transport.sendMail({
-      from: process.env.EMAIL_FROM ?? 'AllBlue <no-reply@localhost>',
-      to: msg.to,
-      replyTo: msg.replyTo,
-      subject: msg.subject,
-      html: msg.html,
-      text: msg.text,
-      headers: msg.headers,
-    })
-    return { messageId: info.messageId ?? null, bounced: info.rejected.length > 0 }
-  } finally {
-    transport.close()
-  }
+  cachedKey = key
+  return cachedTransport
+}
+
+export async function sendBySmtp(msg: EmailMessage): Promise<{ messageId: string | null; bounced: boolean }> {
+  const transport = getTransport()
+  const info = await transport.sendMail({
+    from: process.env.EMAIL_FROM ?? 'AllBlue <no-reply@localhost>',
+    to: msg.to,
+    replyTo: msg.replyTo,
+    subject: msg.subject,
+    html: msg.html,
+    text: msg.text,
+    headers: msg.headers,
+  })
+  // 单例连接池跨调用复用，不在此关闭（审计 A4x-1 🟡：原逐封 close 使连接池失效）
+  return { messageId: info.messageId ?? null, bounced: info.rejected.length > 0 }
 }

package/src/server/email/templates/product/changelog-release.tsx

@@ -40,7 +40,7 @@ function ChangelogReleaseEmail({ locale, version, highlights, detailUrl, unsubsc
         <Section className="mb-8">
           <Text className="text-sm text-fg-3 m-0 mb-2 font-sans">{t.highlightsLabel}</Text>
           {highlightsList.map((line, i) => (
-            <Text key={i} className="font-14 text-fg-2 m-0 font-sans">· {line}</Text>
+            <Text key={i} className="text-sm text-fg-2 m-0 font-sans">· {line}</Text>
           ))}
         </Section>
       ) : null}

package/src/server/email/templates/team/invite.tsx

@@ -17,7 +17,7 @@ const T = {
     preview: '你收到一个团队邀请',
     heading: '团队邀请',
     greeting: '你好：',
-    body: (owner: string) => `${owner || '团队成员'} 邀请你加入 AllBlue 团队。点击下方按钮接受邀请（${'过期时间见下'}）。`,
+    body: (owner: string) => `${owner || '团队成员'} 邀请你加入 AllBlue 团队。点击下方按钮接受邀请（过期时间见下）。`,
     cta: '接受邀请',
     expiresLabel: '有效期至：',
   },

package/src/server/entitlements-token.ts

@@ -36,7 +36,8 @@ async function getSigningKey(): Promise<CryptoKey | null> {
   }
   const encoded = secret.slice('ed25519-pair-'.length)
   const parts = encoded.split('.')
-  if (parts.length < 1 || !parts[0]) {
+  // 死分支已删（审计 🟢）：split('.') 恒 ≥1 元素，length<1 永假
+  if (!parts[0]) {
     throw new Error('Invalid ENTITLEMENTS_SIGNING_SECRET: missing private key')
   }
   const privBytes = base64urlDecode(parts[0])
@@ -106,6 +107,12 @@ export async function generateEntitlementsToken(
   return `${headerEncoded}.${payloadEncoded}.${signatureEncoded}`
 }
 
+/**
+ * ⚠ 不验签（审计 🟡 命名警示）：仅 base64 解码 + JSON.parse，**不校验 EdDSA
+ * 签名**。返回值在签名验证（Rust 侧 verify，见 entitlements-token-client.ts
+ * 的说明）之前不得采信——权益数据可被任意伪造。命名保留 parse 前缀以便
+ * 与 generate 对仗，但调用方必须清楚「parse ≠ verify」。
+ */
 export function parseEntitlementsToken(token: string): EntitlementsToken | null {
   try {
     const parts = token.split('.')

package/src/server/entitlements.ts

@@ -18,7 +18,7 @@
 import { getProService } from '@/server/pro-services'
 import { type LicenseStatus, type ProFeature } from '@allbluecn/kernel'
 import { FeatureRegistry, OSS_BASE_FEATURES, type FeatureKey } from '@allbluecn/kernel'
-import { requireAuth } from '@/server/auth-helpers'
+import { requireAuth, UnauthorizedError } from '@/server/auth-helpers'
 import { prisma } from '@allbluecn/database'
 import { readVerifiedEntitlements } from '@/server/entitlements-token-client'
 
@@ -137,7 +137,12 @@ async function resolveEntitlements(
   }
 
   const session = await requireAuth(request)
-  const userId = session.user!.id!
+  // 显式判空（审计 🟡）：requireAuth 契约保证 user.id 非空，但裸 `!` 链在
+  // 契约外路径（session 形态变化）会抛 TypeError 而非鉴权错误
+  const userId = session.user?.id
+  if (!userId) {
+    throw new UnauthorizedError()
+  }
   const isGuest = session.user?.isGuest === true
   const billing = getProService('billing')