@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/fetch-guard.ts

@@ -48,16 +48,23 @@ export function isDesktopRuntime(): boolean {
  * 判定点分十进制 IPv4 是否落在私网/回环/链路本地/未指定/组播保留段。
  * 这些地址段是 SSRF 的主要攻击面：本机服务（127.0.0.1）、内网资产（10/172.16/192.168）、
  * 云元数据端点（169.254.169.254，可窃取实例凭证）。
+ * IANA 特殊用途段（2026-10 审计补齐）：0.0.0.0/8、100.64/10（CGNAT，Tailscale 等
+ * overlay 网段）、192.0.0.0/24（IETF 协议分配）、198.18/15（基准测试）、
+ * 240/4 与 224/4（保留/组播，a>=224 统一拦截）。
  */
 function isPrivateIPv4(host: string): boolean {
   const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host)
   if (!m) return false
   const a = Number(m[1])
   const b = Number(m[2])
+  const c = Number(m[3])
   if (a === 127 || a === 10 || a === 0) return true
   if (a === 172 && b >= 16 && b <= 31) return true
   if (a === 192 && b === 168) return true
+  if (a === 192 && b === 0 && c === 0) return true
   if (a === 169 && b === 254) return true
+  if (a === 100 && b >= 64 && b <= 127) return true
+  if (a === 198 && (b === 18 || b === 19)) return true
   if (a >= 224) return true
   return false
 }
@@ -180,3 +187,63 @@ export function assertFetchableUrl(
 
   return url
 }
+
+/** 主机是否为 IP 字面量（同步判定已覆盖，无需 DNS 解析复检） */
+function isIpLiteral(host: string): boolean {
+  return host.includes(":") || /^\d{1,3}(\.\d{1,3}){3}$/.test(host) || /^\d+$/.test(host) ||
+    /^0x[0-9a-f]+$/i.test(host) || /^0[0-7]+$/.test(host)
+}
+
+/** 解析后地址是否命中私网/回环/链路本地/元数据段（IPv4 与 IPv6 统一入口） */
+function isPrivateResolvedAddress(address: string): boolean {
+  if (address.includes(":")) return isPrivateIPv6(address)
+  return isPrivateIPv4(normalizeIntegerIp(address) ?? address)
+}
+
+/**
+ * DNS 解析复检（2026-10 审计 🟠 加固，可选项；assertFetchableUrl 的异步深检版）：
+ * 字面量判定之外，把域名解析出的**全部** A/AAAA 记录逐个过私网判定，堵
+ * 「公网域名 A 记录指向 127.0.0.1 / 169.254.169.254」的字面量绕过面。
+ *
+ * ⚠ 残余 TOCTOU（DNS rebinding）：本函数校验后、实际 fetch 前存在二次解析窗口，
+ * 攻击者可用 TTL 0 动态 DNS 令两次解析不同。彻底闭环需自定义 undici Agent
+ * 在 connect 期按本函数解析结果 pin IP（SNI/Host 分离），改动面大未实施；
+ * 调用方对高危端点可将本函数与 fetch 间延迟压到最低，并在网关层叠加 egress
+ * 白名单。故意**不做**进程内解析缓存——缓存「安全」判定会拉长 rebinding 窗口，
+ * 换取的延迟收益对本守卫的非热路径不值得。
+ *
+ * 签名语义：与 assertFetchableUrl 同参同返回（复用其全部字面量判定），
+ * 仅额外追加解析复检；新调用方（用户可控 URL 的 fetch 出口）应优先用本函数。
+ */
+export async function assertFetchableUrlResolved(
+  input: string,
+  options: FetchGuardOptions = {},
+): Promise<URL> {
+  const url = assertFetchableUrl(input, options)
+  const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "")
+  if (isIpLiteral(host)) return url
+
+  // LookupOptions 无 signal（Node 24 类型）：race 一个 3s 定时器，DNS 挂起时不阻塞请求
+  const addresses = await Promise.race([
+    import("node:dns/promises").then(({ lookup }) =>
+      lookup(host, { all: true, verbatim: true }),
+    ),
+    new Promise<never>((_, reject) =>
+      setTimeout(() => reject(new FetchGuardError(input, `DNS 解析超时`)), 3000),
+    ),
+  ])
+  if (addresses.length === 0) {
+    throw new FetchGuardError(input, `主机 ${host} 无 DNS 解析记录`)
+  }
+  if (options.allowPrivate) return url // 显式放行私网：解析复检同语义豁免
+
+  for (const addr of addresses) {
+    if (isPrivateResolvedAddress(addr.address)) {
+      throw new FetchGuardError(
+        input,
+        `DNS 解析结果 ${addr.address} 落在私网/回环/链路本地/元数据段，SSRF 防护拒绝`,
+      )
+    }
+  }
+  return url
+}

package/src/server/iteration/auto-schedule-internal.ts

@@ -53,20 +53,31 @@ export async function ensureUpcomingIterations(projectId: string): Promise<void>
   );
   if (planned.length === 0) return;
   const owner = await prisma.project.findUnique({ where: { id: projectId }, select: { ownerId: true } });
-  await prisma.$transaction([
-    ...planned.map((p) =>
-      prisma.iteration.create({
+  // 非空断言收敛为显式业务错误（审计 🟡）：项目在两次查询间被删除时抛
+  // TypeError 而非鉴权/业务错误，排障噪音大
+  const creatorId = owner?.ownerId;
+  if (!creatorId) throw new Error("项目不存在，无法补建迭代");
+  // 并发仲裁（审计 🟡）：lastSeq 条件更新抢占——两并发请求都读到同一
+  // lastSeq 时，仅赢方（updateMany count=1）创建，输方静默跳过（下次
+  // 自检重入）。交互式事务保证「抢占 + 创建」原子：创建失败回滚抢占。
+  await prisma.$transaction(async (tx) => {
+    const claimed = await tx.iterationAutoSchedule.updateMany({
+      where: { projectId, lastSeq: cfg.lastSeq },
+      data: { lastSeq: nextSeq },
+    });
+    if (claimed.count === 0) return; // 并发对手已推进水位线，放弃本轮
+    for (const p of planned) {
+      await tx.iteration.create({
         data: {
           projectId, name: p.name,
           startDate: new Date(p.startDate + "T00:00:00.000Z"),
           endDate: new Date(p.endDate + "T00:00:00.000Z"),
-          createdById: owner!.ownerId!,
+          createdById: creatorId,
         },
         select: { id: true },
-      }),
-    ),
-    prisma.iterationAutoSchedule.update({ where: { projectId }, data: { lastSeq: nextSeq } }),
-  ]);
+      });
+    }
+  });
 }
 
 /** autoRollover：最近结束迭代 → 未完成需求转移到下一个 active/upcoming（规格 §3.6；无目标跳过） */

package/src/server/iteration/permissions.ts

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 迭代域「资源 → 项目 → 成员」守卫（审计 2026-10-25：getIterationFn / listIterationStoriesFn /
+// getAutoScheduleFn / getIterationBurndownFn 仅 requireAuth，任意登录用户可按 id 读任意项目迭代）。
+
+import { getPrisma } from "@allbluecn/database/get-prisma";
+import { assertProjectMembership } from "@/server/lib/project-membership";
+
+export const ITERATION_FORBIDDEN_MESSAGE = "无权限操作该项目的迭代";
+
+export function assertIterationProjectMembership(projectId: string, userId: string): Promise<void> {
+  return assertProjectMembership(projectId, userId, ITERATION_FORBIDDEN_MESSAGE);
+}
+
+/** 反查迭代所属项目并校验成员资格；返回 projectId */
+export async function assertIterationProjectMember(iterationId: string, userId: string): Promise<string> {
+  const prisma = await getPrisma();
+  const iteration = await prisma.iteration.findUnique({
+    where: { id: iterationId },
+    select: { projectId: true },
+  });
+  if (!iteration) throw new Error("迭代不存在");
+  await assertIterationProjectMembership(iteration.projectId, userId);
+  return iteration.projectId;
+}

package/src/server/iteration/transfer-internal.ts

@@ -18,14 +18,16 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { deriveIterationStatus, toDatePart } from "@/lib/iteration/status";
 
-/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
+/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn）：白名单 active——
+ * status 是 String 列（active | invited | suspended，见 schema 注释），
+ * 黑名单排除 suspended 会放行 invited 中间态（审计 🟡 修正） */
 async function assertProjectMembership(projectId: string, userId: string) {
   const prisma = await getPrisma();
   const membership = await prisma.projectMember.findUnique({
     where: { projectId_userId: { projectId, userId } },
     select: { status: true },
   });
-  if (!membership || membership.status === "suspended") {
+  if (!membership || membership.status !== "active") {
     throw new Error("无权限操作该项目的迭代");
   }
 }
@@ -70,17 +72,22 @@ export async function transferStoriesInternal(
   let actorId = userId;
   if (!actorId) {
     const owner = await prisma.project.findUnique({ where: { id: target.projectId }, select: { ownerId: true } });
-    actorId = owner!.ownerId!;
+    actorId = owner?.ownerId;
+    if (!actorId) throw new Error("项目不存在，无法转移需求");
   }
-  await prisma.story.updateMany({ where: { id: { in: ids } }, data: { iterationId: targetIterationId } });
-  await prisma.storyActivity.createMany({
-    data: ids.map((storyId) => ({
-      storyId,
-      userId: actorId,
-      action: "iteration_changed",
-      field: "iterationId",
-      newValue: target.name,
-    })),
+  // 双表写收进事务（审计 🟡）：转移成功但活动记录写失败时不再出现
+  // 「需求已转移却无审计痕迹」的不一致态
+  await prisma.$transaction(async (tx) => {
+    await tx.story.updateMany({ where: { id: { in: ids } }, data: { iterationId: targetIterationId } });
+    await tx.storyActivity.createMany({
+      data: ids.map((storyId) => ({
+        storyId,
+        userId: actorId,
+        action: "iteration_changed",
+        field: "iterationId",
+        newValue: target.name,
+      })),
+    });
   });
   return ids.length;
 }

package/src/server/keepalive/middleware.ts

@@ -19,21 +19,31 @@ import { createMiddleware } from '@tanstack/react-start'
 
 const KEEPALIVE_INTERVAL = 4 * 60 * 1000
 
+// 审计 🟢：以 declare global 消除 (globalThis as any) 类型逃逸
+declare global {
+  // eslint-disable-next-line no-var
+  var __lastNeonKeepaliveAt: number | undefined
+}
+
 export const neonKeepaliveMiddleware = createMiddleware().server(async ({ next }) => {
   const now = Date.now()
-  const last = ((globalThis as any).__lastNeonKeepaliveAt as number | undefined) || 0
+  const last = globalThis.__lastNeonKeepaliveAt ?? 0
 
   if (now - last <= KEEPALIVE_INTERVAL) {
     return next()
   }
 
+  // 竞态占位（审计 🟡 已知取舍）：进入时先写标记再异步探测——冷启动并发
+  // 请求只放行一次 SELECT 1；探测失败的代价是本轮跳过（4 分钟后重试），
+  // 相比「写回成功后才置位」的重复探测更可控
+  globalThis.__lastNeonKeepaliveAt = now
+
   const [result] = await Promise.all([
     next(),
     (async () => {
       try {
         const { prisma } = await import('@allbluecn/database')
         await prisma.$queryRawUnsafe('SELECT 1')
-        ;(globalThis as any).__lastNeonKeepaliveAt = Date.now()
       } catch (e) {
         console.warn('[neon-keepalive] error', e instanceof Error ? e.message : String(e))
       }

package/src/server/knowledge/kb-doc-search.ts

@@ -102,11 +102,28 @@ export async function searchGeneralGroupDocs(
   }));
 }
 
-/** 当前用户可作为快捷文档来源的 team 库 id 集合 */
-export async function listUserTeamKbIds(userId: string): Promise<string[]> {
+/**
+ * 当前用户可作为快捷文档来源的 team 库 id 集合。
+ *
+ * 口径注记（2026-10 审计 🟡【疑似】核实结论）：KnowledgeBase 的 team 可见性
+ * 在 knowledge.ts 的读权限谓词是 `OR: [{ userId }, { visibility: 'team' }]`
+ * ——team 库对全体登录用户可读、与创建者无关。本函数保留 `userId` 过滤是
+ * **收窄**口径（只回自己名下的 team 库），非越权风险；工作空间快捷文档场景
+ * 漏 teammate 的 team 库属完整性缺口，消费方（workspace-kb.ts）可传
+ * workspaceId 把范围收敛到「本工作空间的 team 库」。
+ */
+export async function listUserTeamKbIds(
+  userId: string,
+  opts?: { workspaceId?: string },
+): Promise<string[]> {
   const prisma = await getPrisma();
   const rows = await prisma.knowledgeBase.findMany({
-    where: { visibility: "team", isDeleted: false, userId },
+    where: {
+      visibility: "team",
+      isDeleted: false,
+      userId,
+      ...(opts?.workspaceId ? { workspaceId: opts.workspaceId } : {}),
+    },
     select: { id: true },
   });
   return rows.map((r) => r.id);

package/src/server/knowledge/knowledge-index-utils.ts

@@ -17,10 +17,11 @@
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { generateEmbedding, chunkText, resolveDefaultProviderConfig } from "@/server/ai-gateway"
+import { OPENROUTER_BASE_URL } from "@/server/ai-gateway/embedding"
 import { getVectorStore } from "@/lib/vector-store"
 
 export const KB_EMBEDDINGS_TABLE = "knowledge_embeddings"
-const OPENROUTER_BASE_URL = "https://openrouter.ai/api/v1"
+// 审计 🔵：OpenRouter base URL 常量收敛单源（ai-gateway/embedding.ts 已有同值导出）
 const PLACEHOLDER_KEYS = new Set(["sk-your-api-key-here", "", "sk-or-your-api-key-here"])
 
 // embeddings 走 OpenAI 兼容的 /embeddings 端点，仅这两个 adapterKind 可用；
@@ -101,13 +102,25 @@ export async function indexDocumentEmbeddings(
   const chunks = chunkText(text)
   await store.deleteEmbeddings(KB_EMBEDDINGS_TABLE, "documentId", doc.id)
 
-  for (let i = 0; i < chunks.length; i++) {
-    const embedding = await generateEmbedding(chunks[i], aiOpts)
-    await store.insertEmbedding(KB_EMBEDDINGS_TABLE, `${doc.id}-${i}`, chunks[i], embedding, {
-      kbId: doc.kbId,
-      documentId: doc.id,
-      chunkIndex: i,
-    })
+  // 失败补偿（审计 🟡：重索引非原子——原实现中途失败留下「旧向量已删、
+  // 新向量半写」的残缺检索面且无自愈）：任一 chunk 失败即清空该 doc 全部
+  // 向量并抛错，调用方（reindex 端点 / 文档更新链路）下次触发全量重建。
+  try {
+    // 逐 chunk 串行 await 是刻意取舍（审计 ⚪）：embedding provider 有并发
+    // 限速，批量并发易 429；长文档索引延迟线性放大可接受（后台任务）。
+    for (let i = 0; i < chunks.length; i++) {
+      const embedding = await generateEmbedding(chunks[i], aiOpts)
+      await store.insertEmbedding(KB_EMBEDDINGS_TABLE, `${doc.id}-${i}`, chunks[i], embedding, {
+        kbId: doc.kbId,
+        documentId: doc.id,
+        chunkIndex: i,
+      })
+    }
+  } catch (error) {
+    await store
+      .deleteEmbeddings(KB_EMBEDDINGS_TABLE, "documentId", doc.id)
+      .catch(() => {})
+    throw error
   }
 
   return chunks.length

package/src/server/knowledge/public/favicon.ts

@@ -15,7 +15,11 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-import { assertFetchableUrl } from '@/server/fetch-guard'
+import { assertFetchableUrlResolved } from '@/server/fetch-guard'
+
+/** HTML 解析读取上限（审计 🟡：目标站点超大响应全量入内存；前 256KB 足够
+ * 匹配 <link> 标签） */
+const FAVICON_HTML_MAX_BYTES = 256 * 1024
 
 export async function resolveFavicon(rawUrl: string): Promise<string> {
   let origin: string
@@ -30,16 +34,19 @@ export async function resolveFavicon(rawUrl: string): Promise<string> {
   }
 
   try {
-    // SEC-05：favicon 同步出口统一走 SSRF 守卫；拒绝时落入下方 catch，
-    // 与网络失败同路径降级为 Google s2 兜底（域名参数对私网无探测作用）
-    const target = assertFetchableUrl(rawUrl)
+    // SEC-05：favicon 同步出口统一走 SSRF 守卫（2026-10 升级为 DNS 解析后
+    // IP 复检的深检版）；拒绝时落入下方 catch，与网络失败同路径降级为
+    // Google s2 兜底（域名参数对私网无探测作用）
+    const target = await assertFetchableUrlResolved(rawUrl)
     const res = await fetch(target, {
       redirect: 'error',
       signal: AbortSignal.timeout(5000),
       headers: { 'User-Agent': 'AllBlue-KnowledgeBase' },
     })
     if (res.ok) {
-      const html = await res.text()
+      const text = await res.text()
+      // 256KB 截断后再匹配：超大恶意页面不再全量驻留
+      const html = text.slice(0, FAVICON_HTML_MAX_BYTES)
       const match =
         html.match(/<link[^>]*rel=["'](?:shortcut icon|icon|apple-touch-icon)["'][^>]*>/i) ||
         html.match(/<link[^>]*href=["'][^"']*\.(?:png|ico|svg|jpg)["'][^>]*>/i)
@@ -49,7 +56,13 @@ export async function resolveFavicon(rawUrl: string): Promise<string> {
           const href = hrefMatch[1]
           if (/^https?:\/\//i.test(href)) return href
           if (href.startsWith('//')) return `https:${href}`
-          return `${origin}${href.startsWith('/') ? '' : '/'}${href}`
+          // 相对路径按 base URL 规范解析（审计 🟡：手工拼接丢路径上下文，
+          // `https://x.com/a/b/` 下的 icon.ico 被错误拼到根路径 → 404）
+          try {
+            return new URL(href, target).toString()
+          } catch {
+            return `${origin}/favicon.ico`
+          }
         }
       }
       return `${origin}/favicon.ico`
@@ -61,6 +74,11 @@ export async function resolveFavicon(rawUrl: string): Promise<string> {
   return `https://www.google.com/s2/favicons?domain=${encodeURIComponent(hostname)}&sz=64`
 }
 
+/**
+ * ⚠ 前置条件（审计 ⚪）：本函数按 bookmarkId 直查直写、**无属主校验**，
+ * 调用方（serverFn）必须先做属主校验（websiteBookmark.userId === session
+ * user）再调用；新增调用点漏检即水平越权写他人书签的 favicon 字段。
+ */
 export async function syncBookmarkFavicon(bookmarkId: string): Promise<string | null> {
   const { prisma } = await import('@allbluecn/database')
   const bm = await prisma.websiteBookmark.findUnique({

package/src/server/knowledge/public/github-sync.ts

@@ -43,6 +43,13 @@ const HEADERS: HeadersInit = {
     : {}),
 }
 
+// 外部 fetch 超时（审计 🟡）：GitHub 或网络层挂起不再卡死 syncAll 循环
+// （同目录 favicon.ts 的 5s 惯例；批量场景放宽到 10s）
+const GITHUB_FETCH_TIMEOUT_MS = 10_000
+// 批量同步单轮上限（审计 🟡）：无上限 + 串行会耗尽 GitHub 未认证限额
+// （60 req/h），后续全部失败；单轮 50 留下一轮 6h 窗口消化
+const GITHUB_SYNC_BATCH_LIMIT = 50
+
 function isAllowedGitHubUrl(url: string): boolean {
   try {
     const parsed = new URL(url)
@@ -57,22 +64,32 @@ export async function fetchGithubData(
   owner: string,
   repo: string,
 ): Promise<GithubData | null> {
-  const repoUrl = `${API}/repos/${owner}/${repo}`
+  // owner/repo 来自书签 URL 解析（parseGithubUrl），编码后拼 path 防输
+  // 入卫生缺陷（`?`/`#`/`/` 改写请求端点；host 已白名单钉死无 SSRF）
+  const repoUrl = `${API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`
   if (!isAllowedGitHubUrl(repoUrl)) {
     throw new Error('URL not allowed')
   }
-  const repoRes = await fetch(repoUrl, { headers: HEADERS, redirect: 'error' })
+  const repoRes = await fetch(repoUrl, {
+    headers: HEADERS,
+    redirect: 'error',
+    signal: AbortSignal.timeout(GITHUB_FETCH_TIMEOUT_MS),
+  })
   if (!repoRes.ok) return null
   const repoJson: GithubRepoJson = await repoRes.json()
 
   let latestVersion: string | null = null
   let versionDate: Date | null = null
   try {
-    const relUrl = `${API}/repos/${owner}/${repo}/releases/latest`
+    const relUrl = `${API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/releases/latest`
     if (!isAllowedGitHubUrl(relUrl)) {
       throw new Error('URL not allowed')
     }
-    const relRes = await fetch(relUrl, { headers: HEADERS, redirect: 'error' })
+    const relRes = await fetch(relUrl, {
+      headers: HEADERS,
+      redirect: 'error',
+      signal: AbortSignal.timeout(GITHUB_FETCH_TIMEOUT_MS),
+    })
     if (relRes.ok) {
       const relJson: GithubReleaseJson = await relRes.json()
       latestVersion = relJson.tag_name ?? null
@@ -125,6 +142,9 @@ export async function syncAllStaleGithubBookmarks(): Promise<number> {
       ],
     },
     select: { id: true },
+    // 批量上限：单轮 50（GITHUB_SYNC_BATCH_LIMIT），余量留给下一轮（cron
+    // 周期触发），防 GitHub 未认证 60/h 限额耗尽后全量失败
+    take: GITHUB_SYNC_BATCH_LIMIT,
   })
   let count = 0
   for (const bm of stale) {

package/src/server/knowledge/public/share-merge.ts

@@ -30,6 +30,10 @@ interface ShareInput {
 
 export type ShareResult = { action: 'created' | 'appended' | 'already' }
 
+// 三个公共域（bookmark/compliance/dictionary）share serverFn 的提示文案单一来源
+// （审计 2026-10-25 🔵：同一份字面量曾逐行重复三处）。服务端返回中文文案是既有
+// 契约（客户端 toast 直显）；i18n 化（返回 action 枚举由客户端经 m.xxx() 渲染）
+// 需要同步改 4 个路由组件，见审计报告「待决策」。
 export interface PublicSharer {
   id: string
   username: string
@@ -56,36 +60,65 @@ const modelDelegates = {
 }
 
 export async function shareToPublic(input: ShareInput): Promise<ShareResult> {
-  const { model, entityType, userId, cloneData } = input
+  const { model, entityType, userId, cloneData, fields } = input
   const canonicalId = String(cloneData.canonicalId)
   const table = modelDelegates[model] as unknown as PublicModelDelegate
 
+  // mass-assignment 防线（审计 🟡）：声明的 fields 白名单真正落地——提供时
+  // 仅放行白名单列（isDeleted 等内部列无论是否声明都强制剔除），未提供时
+  // 仍剔除三把保留键（旧行为）
+  const RESERVED_KEYS = new Set(['canonicalId', 'visibility', 'userId', 'isDeleted'])
+  const pickAllowed = (data: Record<string, unknown>): Record<string, unknown> => {
+    const stripped: Record<string, unknown> = {}
+    for (const [key, value] of Object.entries(data)) {
+      if (RESERVED_KEYS.has(key)) continue
+      if (fields && !fields.includes(key)) continue
+      stripped[key] = value
+    }
+    return stripped
+  }
+
   const existing = await table.findFirst({
     where: { canonicalId, visibility: 'public', isDeleted: false },
     select: { id: true, canonicalId: true },
   })
 
   if (existing) {
-    const { canonicalId: _cid, visibility: _vis, userId: _uid, ...updateData } = cloneData
-    await table.update({ where: { id: existing.id }, data: updateData })
-    const already = await prisma.knowledgeShareRecord.findFirst({
-      where: { entityType, canonicalId, userId },
-      select: { id: true },
-    })
-    if (already) return { action: 'already' }
-    await prisma.knowledgeShareRecord.create({
-      data: { entityType, canonicalId, userId },
+    const updateData = pickAllowed(cloneData)
+    // 双写收进事务（审计 🟡）：更新与 share 记录原子，防「已追加无记录」半态；
+    // tx 内经同名 model 取事务绑定的 delegate（顶层 delegates 绑全局 client）
+    let action: ShareResult['action'] = 'appended'
+    await prisma.$transaction(async (tx) => {
+      const txTable = (tx as unknown as Record<string, PublicModelDelegate>)[model]
+      await txTable.update({ where: { id: existing.id }, data: updateData })
+      const already = await tx.knowledgeShareRecord.findFirst({
+        where: { entityType, canonicalId, userId },
+        select: { id: true },
+      })
+      if (already) {
+        action = 'already'
+        return
+      }
+      await tx.knowledgeShareRecord.create({
+        data: { entityType, canonicalId, userId },
+      })
     })
-    return { action: 'appended' }
+    return { action }
   }
 
-  const { canonicalId: _c, visibility: _v, userId: _u, ...restData } = cloneData
-  await table.update({
-    where: { id: input.sourceId },
-    data: { visibility: 'public', ...restData },
-  })
-  await prisma.knowledgeShareRecord.create({
-    data: { entityType, canonicalId, userId },
+  const restData = pickAllowed(cloneData)
+  // 并发首分享竞态（审计 🟡 已知取舍）：两用户并发 share 同 canonicalId 且
+  // DB 无 (canonicalId, visibility) 唯一约束时可能双写 public 行——schema
+  // 加唯一约束属另一批次工作，此处保留行为并注明
+  await prisma.$transaction(async (tx) => {
+    const txTable = (tx as unknown as Record<string, PublicModelDelegate>)[model]
+    await txTable.update({
+      where: { id: input.sourceId },
+      data: { visibility: 'public', ...restData },
+    })
+    await tx.knowledgeShareRecord.create({
+      data: { entityType, canonicalId, userId },
+    })
   })
   return { action: 'created' }
 }

package/src/server/lib/api-key-cipher.ts

@@ -15,7 +15,8 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-// apps/web/src/lib/crypto/api-key-cipher.ts
+// apps/web/src/server/lib/api-key-cipher.ts（2026-10 审计 🟢：头部路径注释
+// 指向旧 src/lib/crypto/ 位置，已修正）
 // ⚠ 仅服务端 import。依赖 node:crypto，禁止在客户端组件/路由文件顶层引用。
 import { createCipheriv, createDecipheriv, randomBytes, createHash } from "node:crypto"
 

package/src/server/lib/bug-sequence.ts

@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// BUG 发号助手（2026-10 审计 🔵 抽取）：collect-handler / report-handler 重复的
+// 「事务内 sequenceCounter upsert + displayId prefix 清洗 + <prefix>-B<seq>」
+// 收敛单源，防重试次数 / prefix 规则漂移。调用方配
+// server/lib/sequence-number-retry.ts 的 withSequenceNumberRetry 承担
+// identifier/scope P2002 重试。纯模块（Prisma 仅 type import），照
+// serverFns 树外先例放置；serverFns/bug/bug-crud.ts 的「存量 max 自愈」
+// 版本暂未迁移（其增强逻辑不同，迁移待后续任务）。
+import type { Prisma } from '@allbluecn/database'
+
+/** 项目 displayId/name → BUG identifier 前缀（非字母数字剔除，空回落 PRJ） */
+export function buildBugPrefix(
+  displayId: string | null | undefined,
+  name: string | null | undefined,
+): string {
+  return (
+    (displayId ?? name ?? '')
+      .replace(/[^a-zA-Z0-9]/g, '')
+      .toUpperCase() || 'PRJ'
+  )
+}
+
+/**
+ * 事务内 BUG 发号：scope=bug:<projectId> 计数器 upsert（与 Story 裸 projectId
+ * 序列隔离），返回 seq 与组装好的 identifier。须在调用方的 $transaction 内使用
+ * （计数器行 UPDATE 串行化同项目并发创建）；identifier 撞号由
+ * withSequenceNumberRetry 在事务外重试。
+ */
+export async function allocateBugSequence(
+  tx: Pick<Prisma.TransactionClient, 'sequenceCounter'>,
+  projectId: string,
+  prefix: string,
+): Promise<{ seq: number; identifier: string }> {
+  const counter = await tx.sequenceCounter.upsert({
+    where: { scope: `bug:${projectId}` },
+    create: { scope: `bug:${projectId}`, seq: 1 },
+    update: { seq: { increment: 1 } },
+  })
+  return { seq: counter.seq, identifier: `${prefix}-B${counter.seq}` }
+}
+
+/** 是否为 BUG 指纹唯一冲突（@@unique([projectId, fingerprint])）：
+ * 调用方据此降级为「并发同指纹，重查后走计数分支」而非重试。
+ * 鸭子类型判定（不要求 Error 实例）——与调用方既有 catch 口径一致，
+ * 测试桩以裸对象形态模拟 PrismaClientKnownRequestError。 */
+export function isBugFingerprintConflict(e: unknown): boolean {
+  const withCode = e as { code?: unknown; meta?: { target?: unknown } } | null;
+  if (!withCode || withCode.code !== 'P2002') return false
+  const target = withCode.meta?.target
+  return Array.isArray(target) && target.includes('fingerprint')
+}