@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/mcp/__tests__/json-rpc.test.ts

@@ -414,21 +414,73 @@ describe("handleMcpPost 鉴权与限流", () => {
 
   it("限流按 tokenHash 120 次/60 秒 → 超限 429 + Retry-After", async () => {
     mocks.tokenFindUnique.mockResolvedValue(TOKEN_ROW);
-    mocks.checkRateLimit.mockReturnValueOnce({
-      allowed: false,
-      retryAfterMs: 42_000,
-    });
+    // 第一段消费鉴权前置 per-IP 桶（2026-10 审计新增），第二段才是 token 桶
+    mocks.checkRateLimit
+      .mockReturnValueOnce({ allowed: true, retryAfterMs: 0 })
+      .mockReturnValueOnce({ allowed: false, retryAfterMs: 42_000 });
     const res = await postWithBearer({ jsonrpc: "2.0", id: 1, method: "ping" });
     expect(res.status).toBe(429);
     expect(res.headers.get("retry-after")).toBe("42");
+    // 单消息 POST 权重 1（审计 🟠：batch 按 entries.length 计权）
     expect(mocks.checkRateLimit).toHaveBeenCalledWith(
-      expect.stringContaining("bug-mcp"),
+      expect.stringContaining("bug-mcp:"),
       { max: 120, windowMs: 60_000 },
+      1,
     );
     const body = await res.json();
     expect(body.error).toBeDefined();
   });
 
+  it("batch 按 entries.length 计权限流（审计 🟠：放大防护）", async () => {
+    mocks.tokenFindUnique.mockResolvedValue(TOKEN_ROW);
+    const res = await postWithBearer([
+      { jsonrpc: "2.0", id: 1, method: "ping" },
+      { jsonrpc: "2.0", id: 2, method: "ping" },
+      { jsonrpc: "2.0", id: 3, method: "ping" },
+    ]);
+    expect(res.status).toBe(200);
+    expect(mocks.checkRateLimit).toHaveBeenCalledWith(
+      expect.stringContaining("bug-mcp:"),
+      { max: 120, windowMs: 60_000 },
+      3,
+    );
+  });
+
+  it("batch 超过 MCP_MAX_BATCH_SIZE → 400 -32600（整批拒绝）", async () => {
+    mocks.tokenFindUnique.mockResolvedValue(TOKEN_ROW);
+    const oversize = Array.from({ length: 25 }, (_, i) => ({
+      jsonrpc: "2.0",
+      id: i + 1,
+      method: "ping",
+    }));
+    const res = await postWithBearer(oversize);
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error.code).toBe(-32600);
+    expect(body.error.message).toContain("batch size");
+  });
+
+  it("请求体超过 MCP_MAX_BODY_BYTES → 413", async () => {
+    mocks.tokenFindUnique.mockResolvedValue(TOKEN_ROW);
+    const res = await postWithBearer({
+      jsonrpc: "2.0",
+      id: 1,
+      method: "ping",
+      params: { pad: "x".repeat(1024 * 1024 + 1) },
+    });
+    expect(res.status).toBe(413);
+  });
+
+  it("鉴权前置 per-IP 桶超限 → 429（不触达 token 查库）", async () => {
+    mocks.checkRateLimit
+      .mockReturnValueOnce({ allowed: false, retryAfterMs: 7_000 })
+      .mockReturnValueOnce({ allowed: true, retryAfterMs: 0 });
+    const res = await postWithBearer({ jsonrpc: "2.0", id: 1, method: "ping" });
+    expect(res.status).toBe(429);
+    // IP 桶拦截后未走 token 查库（审计 🟡：随机格式合法 token 的 DB 放大面）
+    expect(mocks.tokenFindUnique).not.toHaveBeenCalled();
+  });
+
 // ── handleMcpGetRequest：GET → 405（路由层委托，§10.1 权威约束项）──
 describe("handleMcpGetRequest", () => {
   it("GET → 405 + Allow 头含 POST（无状态模式不提供 SSE 流）", () => {

package/src/server/mcp/__tests__/tools.test.ts

@@ -46,6 +46,8 @@ const mocks = vi.hoisted(() => ({
   testRunFindFirst: vi.fn(),
   testRunFindUnique: vi.fn(),
   testRunUpdate: vi.fn(),
+  // finalize arbiter（审计 🟡）：run 落账改条件 updateMany
+  testRunUpdateMany: vi.fn(),
   testRunCaseFindMany: vi.fn(),
   testRunCaseFindUnique: vi.fn(),
   testRunCaseUpdate: vi.fn(),
@@ -58,6 +60,8 @@ const mocks = vi.hoisted(() => ({
   transaction: vi.fn(),
   collabDocumentFindUnique: vi.fn(),
   scheduleFlakyRetry: vi.fn(),
+  // list_bugs 全量计数（审计 ⚪：total 语义修正为真实 count）
+  bugCount: vi.fn(),
 }));
 
 vi.mock("@allbluecn/database", () => ({
@@ -67,6 +71,7 @@ vi.mock("@allbluecn/database", () => ({
       findFirst: mocks.bugFindFirst,
       update: mocks.bugUpdate,
       create: mocks.bugCreate,
+      count: mocks.bugCount,
     },
     bugFixRun: {
       findFirst: mocks.fixRunFindFirst,
@@ -80,6 +85,7 @@ vi.mock("@allbluecn/database", () => ({
       findFirst: mocks.testRunFindFirst,
       findUnique: mocks.testRunFindUnique,
       update: mocks.testRunUpdate,
+      updateMany: mocks.testRunUpdateMany,
     },
     testRunCase: {
       findMany: mocks.testRunCaseFindMany,
@@ -223,6 +229,7 @@ beforeEach(() => {
   mocks.bugUpdate.mockResolvedValue({});
   mocks.collabDocumentFindUnique.mockResolvedValue(null); // 任务 23：无快照（门卫 pass-through）
   mocks.fixRunUpdateMany.mockResolvedValue({ count: 1 });
+  mocks.bugCount.mockResolvedValue(0);
   mocks.storyFindUnique.mockResolvedValue(null);
   // test 域默认桩：条件更新全部命中、finalize 阶段空集（不触发 run completed）
   mocks.testRunCaseFindMany.mockResolvedValue([]);
@@ -230,6 +237,7 @@ beforeEach(() => {
   mocks.testRunCaseUpdateMany.mockResolvedValue({ count: 1 });
   mocks.testRunFindUnique.mockResolvedValue(null);
   mocks.testRunUpdate.mockResolvedValue({});
+  mocks.testRunUpdateMany.mockResolvedValue({ count: 1 });
   mocks.execRunCreate.mockResolvedValue({ id: "er1" });
   mocks.execRunFindMany.mockResolvedValue([]); // 惰性回收扫描（list_pending_execs 接缝）无过期
   mocks.execRunFindUnique.mockResolvedValue(null);
@@ -1116,8 +1124,9 @@ describe("report_exec_result", () => {
       { runCaseId: "rc1", finalVerdict: "pass", summaryText: "全过" },
       testCtx,
     );
-    expect(mocks.testRunUpdate).toHaveBeenCalledWith({
-      where: { id: "tr1" },
+    expect(mocks.testRunUpdateMany).toHaveBeenCalledWith({
+      // arbiter 条件更新：仅 running 可落账
+      where: { id: "tr1", status: "running" },
       data: expect.objectContaining({
         status: "completed",
         completedAt: expect.any(Date),
@@ -1152,7 +1161,7 @@ describe("report_exec_result", () => {
       { runCaseId: "rc1", finalVerdict: "pass", summaryText: "x" },
       testCtx,
     );
-    expect(mocks.testRunUpdate).not.toHaveBeenCalled();
+    expect(mocks.testRunUpdateMany).not.toHaveBeenCalled();
     expect(mocks.projectActivityCreate).not.toHaveBeenCalled();
     expect(mocks.fireTestRunWebhook).not.toHaveBeenCalled();
     expect(payload.runCompleted).toBe(false);

package/src/server/mcp/json-rpc.ts

@@ -107,6 +107,18 @@ export function validateJsonRpcMessage(raw: unknown): MessageEntry {
   if (!isPlainObject(raw)) return { valid: false, id };
   if (raw.jsonrpc !== JSONRPC_VERSION) return { valid: false, id };
   if (typeof raw.method !== "string") return { valid: false, id };
+  // id 成员存在但类型非法（规范仅允许 string | number | null，审计 🟡）：
+  // 归一为 Invalid Request 而非静默当 notification/请求处理——旧行为
+  // `{id: true}` 会被当请求并以 id:null 回包，客户端无法匹配
+  if (
+    "id" in raw &&
+    raw.id !== undefined &&
+    typeof raw.id !== "string" &&
+    typeof raw.id !== "number" &&
+    raw.id !== null
+  ) {
+    return { valid: false, id };
+  }
   // params 存在时必须是结构化类型（by-name 对象 / by-position 数组）
   if (raw.params !== undefined && raw.params !== null && !hasStructuredParams(raw.params)) {
     return { valid: false, id };

package/src/server/mcp/protocol.ts

@@ -21,6 +21,7 @@
 // 202 / ping / tools:list+call 分发表）。不发放 Mcp-Session-Id（无状态）；GET SSE
 // 流由路由层 405 拒绝。路由层薄壳（routes/api/mcp/bugs.ts）只做 handler 委托。
 import { prisma } from "@allbluecn/database";
+import { getClientIp } from "@allbluecn/kernel";
 import {
   ERR_INTERNAL_ERROR,
   ERR_INVALID_PARAMS,
@@ -49,6 +50,14 @@ export const SUPPORTED_PROTOCOL_VERSIONS = [
 export const DEFAULT_PROTOCOL_VERSION = "2025-03-26";
 export const MCP_SERVER_INFO = { name: "allblue-bugs", version: "1.0.0" } as const;
 export const MCP_RATE_LIMIT = { max: 120, windowMs: 60_000 } as const;
+// 审计 🟠：batch 放大防护——单 POST batch 条数上限（超限 400 整批拒绝，
+// MCP 规范亦建议拒绝超大 batch），限流按 batch 内消息条数计权
+export const MCP_MAX_BATCH_SIZE = 20;
+// 审计 🟡：请求体上限（自托管无平台 body 上限兜底；1MB 已远超合法 MCP 载荷）
+export const MCP_MAX_BODY_BYTES = 1024 * 1024;
+// 审计 🟡：鉴权前置 per-IP 桶——格式合法的随机 token 可无限触发哈希+唯一索引
+// 查询；与 token 桶同阈值，正常单 token 客户端不受影响
+export const MCP_AUTH_IP_RATE_LIMIT = { max: 120, windowMs: 60_000 } as const;
 
 // 服务端自定义错误码（JSON-RPC 规范保留段 -32000..-32099）
 export const CODE_UNAUTHORIZED = -32000;
@@ -246,6 +255,19 @@ export async function handleMcpRequest(
     return respondToEntry(payload.entry);
   }
 
+  // 审计 🟠：超大 batch 整批拒绝（handleMcpPost 已按条数计权限流，此处是
+  // 契约层兜底——直接调用本函数的测试/内部路径同样受限）
+  if (payload.entries.length > MCP_MAX_BATCH_SIZE) {
+    return jsonRpcHttpResponse(
+      400,
+      jsonRpcError(
+        null,
+        ERR_INVALID_REQUEST,
+        `Invalid Request: batch size ${payload.entries.length} exceeds limit ${MCP_MAX_BATCH_SIZE}`,
+      ),
+    );
+  }
+
   const responses: JsonRpcResponse[] = [];
   for (const entry of payload.entries) {
     if (!entry.valid) {
@@ -269,6 +291,20 @@ export async function handleMcpRequest(
  * 未登记 scope（如 bug.report/bug.collect）不授予 MCP 访问。
  */
 export async function handleMcpPost(request: Request): Promise<Response> {
+  // ── 鉴权前置 per-IP 限流（审计 🟡）：格式合法的随机 token 在查库被拒之前
+  // 先被 per-IP 桶拦下，DB 哈希+唯一索引查询不再无上限；阈值与 token 桶一致，
+  // 正常单 token 客户端不受影响 ──
+  const ipLimit = checkRateLimit(
+    `bug-mcp-auth:${getClientIp(request) ?? "unknown"}`,
+    { ...MCP_AUTH_IP_RATE_LIMIT },
+  );
+  if (!ipLimit.allowed) {
+    return new Response(
+      JSON.stringify(jsonRpcError(null, CODE_RATE_LIMITED, "Rate limit exceeded")),
+      { status: 429, headers: { "Content-Type": "application/json" } },
+    );
+  }
+
   // ── 鉴权：Authorization: Bearer <token>（X-Bug-Key 的 Bearer 版口径）──
   const authHeader = request.headers.get("authorization") ?? "";
   const bearer = /^Bearer\s+(.+)$/i.exec(authHeader)?.[1]?.trim() ?? "";
@@ -285,8 +321,20 @@ export async function handleMcpPost(request: Request): Promise<Response> {
     return unauthorizedResponse("Unauthorized: token scope does not grant MCP access");
   }
 
-  // ── 限流：按 tokenHash 120 次/分钟（内存滑动窗口，照 report-handler 口径）──
-  const limit = checkRateLimit(`bug-mcp:${token.tokenHash}`, { ...MCP_RATE_LIMIT });
+  const rawBody = await request.text();
+  // ── 请求体上限（审计 🟡）：自托管部署无平台 body 上限兜底 ──
+  if (Buffer.byteLength(rawBody) > MCP_MAX_BODY_BYTES) {
+    return jsonRpcHttpResponse(
+      413,
+      jsonRpcError(null, ERR_INVALID_REQUEST, "Invalid Request: payload too large"),
+    );
+  }
+
+  // ── 限流（审计 🟠：按消息条数计权而非按 POST 计 1 次——单 POST 塞数千条
+  // tools/call 原本只耗 1 个配额，120 次/分钟被批量放大数万倍）──
+  const probe = parseJsonRpcPayload(rawBody);
+  const weight = probe.ok ? (probe.isBatch ? probe.entries.length : 1) : 1;
+  const limit = checkRateLimit(`bug-mcp:${token.tokenHash}`, { ...MCP_RATE_LIMIT }, weight);
   if (!limit.allowed) {
     return new Response(
       JSON.stringify(
@@ -309,7 +357,6 @@ export async function handleMcpPost(request: Request): Promise<Response> {
     .update({ where: { id: token.id }, data: { lastUsedAt: new Date() } })
     .catch(() => {});
 
-  const rawBody = await request.text();
   return handleMcpRequest(rawBody, {
     auth: { projectId: token.projectId, tokenId: token.id },
     tools: scopeTools,

package/src/server/mcp/tool-schemas.ts

@@ -25,6 +25,12 @@ import { z } from "zod";
 const bugState = z.enum(["open", "in_progress", "fixed", "closed", "wontfix"]);
 const bugSeverity = z.enum(["critical", "high", "medium", "low"]);
 const bugId = z.string().min(1).max(64).describe("BUG ID（list_bugs / get_bug 返回的 id）");
+/** URL 限 http(s)（审计 🟡）：z.string().url() 仅语法校验，javascript:/data:
+ * 均合法——该链接日后在前端以 <a href> 渲染即成 XSS 注入点 */
+const httpsUrl = z
+  .string()
+  .url()
+  .refine((v) => /^https?:\/\//i.test(v), "仅允许 http(s) 链接");
 /** 分页上限统一 50（规格 §10.2 limit?(≤50)），默认值在 handler 侧给（schema 不用 default，避免 toJSONSchema 产 required） */
 const limit = z.number().int().min(1).max(50).describe("返回条数上限（最大 50）");
 
@@ -51,8 +57,8 @@ export const reportResultSchema = z.object({
   bugId,
   result: z.enum(["fixed", "failed", "cannot_reproduce"]).describe("修复结论：fixed 才会置 BUG 为 fixed；failed/cannot_reproduce 不改 BUG 状态"),
   summary: z.string().min(1).max(8000).describe("修复总结（落 run.summary 与活动流）"),
-  commitUrl: z.string().url().max(2000).optional().describe("修复 commit 链接"),
-  prUrl: z.string().url().max(2000).optional().describe("修复 PR 链接"),
+  commitUrl: httpsUrl.max(2000).optional().describe("修复 commit 链接"),
+  prUrl: httpsUrl.max(2000).optional().describe("修复 PR 链接"),
   changedFiles: z.array(z.string().min(1).max(500)).max(200).optional().describe("变更文件清单"),
 });
 

package/src/server/mcp/tools.ts

@@ -160,11 +160,12 @@ const requireBug = async (bugId: string, ctx: McpRequestContext) => {
   return { bug, error: null };
 };
 
-/** 活跃修复任务前置检查：不存在 / 未认领分别给出可操作引导 */
-const requireActiveClaimedRun = async (
-  bugId: string,
+/** 活跃修复任务前置检查：不存在 / 未认领分别给出可操作引导。
+ * 返回 null = run 活跃且已认领（调用方可安全解引用 run）。
+ * （2026-10 审计 🟢：原首参 bugId 函数体内从未使用，删除） */
+const requireActiveClaimedRun = (
   run: { status: string } | null,
-): Promise<string | null> => {
+): string | null => {
   if (!run) return "无活跃修复任务：请先在 AllBlue 项目内创建 AI 修复任务（手动或自动入队），或调用 list_bugs 确认";
   if (run.status === "pending") {
     return "修复任务尚未认领：请先调用 claim_fix 认领后再上报进度/结果";
@@ -211,8 +212,10 @@ async function listBugsHandler(
       });
       bugs.push(...rest);
     }
+    // total = 全量计数（2026-10 审计 ⚪：原为本页条数，MCP 客户端据其判断余量会误判）
+    const total = await prisma.bug.count({ where: baseWhere });
     return ok({
-      total: bugs.length,
+      total,
       bugs: bugs.map((bug) => ({
         id: bug.id,
         identifier: bug.identifier,
@@ -228,14 +231,17 @@ async function listBugsHandler(
     });
   }
 
-  const bugs = await prisma.bug.findMany({
-    where: { ...baseWhere, status: args.status },
-    orderBy: { lastOccurAt: "desc" },
-    take: limit,
-    include: includeActiveRun,
-  });
+  const [bugs, total] = await Promise.all([
+    prisma.bug.findMany({
+      where: { ...baseWhere, status: args.status },
+      orderBy: { lastOccurAt: "desc" },
+      take: limit,
+      include: includeActiveRun,
+    }),
+    prisma.bug.count({ where: { ...baseWhere, status: args.status } }),
+  ]);
   return ok({
-    total: bugs.length,
+    total,
     bugs: bugs.map((bug) => ({
       id: bug.id,
       identifier: bug.identifier,
@@ -362,9 +368,12 @@ async function reportProgressHandler(
   if (!bug) return bugError;
 
   const run = await findActiveRun(bug.id);
-  const runError = await requireActiveClaimedRun(bug.id, run);
-  if (runError) return toolError(runError, { bugId: bug.id });
-  if (!run) return toolError("无活跃修复任务", { bugId: bug.id });
+  const runError = requireActiveClaimedRun(run);
+  // runError 非空已覆盖 !run（提示含「无活跃修复任务」话术）；合并判定后 TS 收窄
+  // run 非空（2026-10 审计 🟢：原独立 `if (!run)` 分支不可达死代码）
+  if (runError !== null || run === null) {
+    return toolError(runError ?? "无活跃修复任务", { bugId: bug.id });
+  }
 
   // 首次进度：claimed → in_progress（条件更新；已 in_progress 不重复转移）
   if (run.status === "claimed") {
@@ -402,9 +411,10 @@ async function reportResultHandler(
   if (!bug) return bugError;
 
   const run = await findActiveRun(bug.id);
-  const runError = await requireActiveClaimedRun(bug.id, run);
-  if (runError) return toolError(runError, { bugId: bug.id });
-  if (!run) return toolError("无活跃修复任务", { bugId: bug.id });
+  const runError = requireActiveClaimedRun(run);
+  if (runError !== null || run === null) {
+    return toolError(runError ?? "无活跃修复任务", { bugId: bug.id });
+  }
 
   const summaryJson = {
     result: args.result,

package/src/server/middlewares/audit-recorder.ts

@@ -1,7 +1,12 @@
 import { getProService } from '../pro-services'
 import { requireFeature } from '@/server/entitlements'
+import { getClientIp } from '@allbluecn/kernel'
 
-const WRITE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE'])
+export const WRITE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE'])
+
+// 安全事件响应码（2026-10 审计 🟡：失败请求恰恰是安全事件高发区——越权尝试、
+// 爆破、限流触发；原先仅记录 <400 的成功请求）
+const AUDITED_FAILURE_STATUSES = new Set([401, 403, 429])
 
 export async function recordAuditEntry(
   request: Request,
@@ -11,7 +16,8 @@ export async function recordAuditEntry(
   const audit = getProService('audit')
   if (!audit) return
   if (!WRITE_METHODS.has(request.method)) return
-  if (!response.status || response.status >= 400) return
+  const isSuccess = response.status < 400
+  if (!isSuccess && !AUDITED_FAILURE_STATUSES.has(response.status)) return
   try {
     await requireFeature(request, 'audit')
   } catch {
@@ -28,7 +34,9 @@ export async function recordAuditEntry(
       resourceType: 'request',
       resourceId: url.pathname,
       metadata: { method: request.method, path, status: response.status },
-      ip: null,
+      // IP 经 kernel getClientIp 可信代理口径提取（2026-10 审计 ⚪：恒 null
+      // 的审计记录无溯源能力）；workspaceId 维度仍留空（多租户映射待 Pro 模块）
+      ip: getClientIp(request),
       userAgent: request.headers.get('user-agent'),
     })
   } catch (err) {

package/src/server/middlewares/audit.ts

@@ -1,20 +1,41 @@
 import { createMiddleware } from '@tanstack/react-start'
+import { getProService } from '../pro-services'
 
+/**
+ * TanStack Start requestMiddleware 管道契约（2026-10 审计 🟠【疑似】已证实）：
+ * `next()` 返回 RequestServerResult（终端响应挂在 `.response` 上，见
+ * start-server-core createStartHandler executeMiddleware），不是 Response 本体。
+ * 原实现 `result instanceof Response` 判定恒 false——写请求审计从未落过账。
+ *
+ * ⚠ audit-recorder（经 entitlements 引 prisma 链）必须保持 handler 内动态 import：
+ * start.ts 是同构文件，顶层静态 import 会把 server-only 依赖拉进客户端 bundle
+ * （start-client-graph 守卫测试钉死此约束）。
+ */
 export const auditRequestMiddleware = createMiddleware().server(async ({ request, next }) => {
   const result = await next()
-  let userId = ''
-  try {
-    const { getCurrentSession } = await import('@/lib/session')
-    const session = await getCurrentSession(request)
-    userId = (session as { user?: { id?: string } } | null)?.user?.id ?? ''
-  } catch {
-    /* 匿名用户不记录 */
-  }
+  const response = result instanceof Response ? result : result.response
+  if (!(response instanceof Response)) return result
 
-  if (result instanceof Response) {
-    const { recordAuditEntry } = await import('./audit-recorder')
-    await recordAuditEntry(request, result, userId)
-  }
+  const { WRITE_METHODS, recordAuditEntry } = await import('./audit-recorder')
+  // 非写请求零开销跳过（session 查询与审计写入都只发生在写方法上）
+  if (!WRITE_METHODS.has(request.method)) return result
+  // OSS 部署 / 审计服务未接入：早退，不为匿名流量付 session 查询
+  if (!getProService('audit')) return result
+
+  // session 查询与请求处理并行（2026-10 审计 ⚪：原先在 next() 之后串行多一次
+  // DB 往返，阻塞响应返回）；匿名用户 userId 留空仍落审计（401/403/429 溯源）
+  const userIdLookup = (async () => {
+    try {
+      const { getCurrentSession } = await import('@/lib/session')
+      const session = await getCurrentSession(request)
+      return (session as { user?: { id?: string } } | null)?.user?.id ?? ''
+    } catch {
+      /* 匿名用户不记录 */
+      return ''
+    }
+  })()
+
+  await recordAuditEntry(request, response, await userIdLookup)
 
   return result
 })

package/src/server/middlewares/auth-rate-limit.ts

@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+import { createFixedWindowRateLimiter } from '@/server/lib/fixed-window-rate-limit'
+
 /**
  * 认证类端点失败限流（SEC-09 登录 / SEC-10 分享密码）——进程内存态固定窗口。
  *
@@ -31,29 +33,12 @@
  * - 账号状态类失败（封禁/未激活）不计入——非口令爆破向量
  */
 
-const store = new Map<string, { count: number; resetAt: number }>()
+// store + 过期清扫定时器收敛到共享实现（2026-10 审计 🔵，与 rate-limit.ts 同源）
+const store = createFixedWindowRateLimiter()
 
 export const LOGIN_RATE_LIMIT = { max: 5, windowMs: 15 * 60 * 1000 } as const
 export const SHARE_PASSWORD_RATE_LIMIT = { max: 10, windowMs: 15 * 60 * 1000 } as const
 
-const CLEANUP_INTERVAL = 60_000
-// 清扫定时器懒启动：workerd 禁止在 global scope（模块顶层）设定时器/fetch
-// （Disallowed operation within global scope），首次进入限流调用（handler
-// 上下文）时才开启；Node 场景行为不变。
-let cleanupStarted = false
-function ensureCleanupTimer() {
-  if (cleanupStarted) return
-  cleanupStarted = true
-  const cleanupTimer = setInterval(() => {
-    const now = Date.now()
-    for (const [key, entry] of store) {
-      if (now > entry.resetAt) store.delete(key)
-    }
-  }, CLEANUP_INTERVAL)
-  // 防止 timer 阻止进程退出（jsdom 环境 setInterval 返回 number，无 unref）
-  cleanupTimer.unref?.()
-}
-
 /** 测试环境豁免（vitest 注入 NODE_ENV=test） */
 export function isAuthRateLimitBypassed(): boolean {
   return process.env.NODE_ENV === 'test'
@@ -61,44 +46,45 @@ export function isAuthRateLimitBypassed(): boolean {
 
 function isBlocked(key: string, max: number): boolean {
   if (isAuthRateLimitBypassed()) return false
-  const entry = store.get(key)
-  if (!entry) return false
-  if (Date.now() > entry.resetAt) {
-    store.delete(key)
-    return false
-  }
-  return entry.count >= max
+  return store.isBlocked(key, max)
 }
 
 function recordFailure(key: string, windowMs: number): void {
   if (isAuthRateLimitBypassed()) return
-  ensureCleanupTimer()
-  const now = Date.now()
-  const entry = store.get(key)
-  if (!entry || now > entry.resetAt) {
-    store.set(key, { count: 1, resetAt: now + windowMs })
-    return
-  }
-  entry.count++
+  store.recordFailure(key, windowMs)
 }
 
+const LOGIN_EMAIL_FALLBACK_RATE_LIMIT = { max: 30, windowMs: 15 * 60 * 1000 } as const
+
 function loginKey(email: string, ip: string | null): string {
   return `login:${email.toLowerCase().trim()}:${ip ?? 'unknown'}`
 }
 
-/** 登录是否已被限流（email+IP 维度）。被限流时调用方应返回与密码错误不可区分的失败。 */
+/** 纯 email 维度兜底桶（2026-10 审计 🟡）：email+IP 复合 key 下攻击者轮换 IP
+ * （代理池）即获得每 IP 全新配额，「按 email 维度仍受限流保护」的注释承诺
+ * 不成立。加更宽阈值的纯 email 桶（30 次/15min）作上限兜底。 */
+function loginEmailKey(email: string): string {
+  return `loginEmail:${email.toLowerCase().trim()}`
+}
+
+/** 登录是否已被限流（email+IP 复合维度 + 纯 email 兜底维度）。被限流时调用方应返回与密码错误不可区分的失败。 */
 export function isLoginBlocked(email: string, ip: string | null): boolean {
-  return isBlocked(loginKey(email, ip), LOGIN_RATE_LIMIT.max)
+  return (
+    isBlocked(loginKey(email, ip), LOGIN_RATE_LIMIT.max) ||
+    isBlocked(loginEmailKey(email), LOGIN_EMAIL_FALLBACK_RATE_LIMIT.max)
+  )
 }
 
 /** 记录一次登录失败（用户不存在或密码错误） */
 export function recordLoginFailure(email: string, ip: string | null): void {
   recordFailure(loginKey(email, ip), LOGIN_RATE_LIMIT.windowMs)
+  recordFailure(loginEmailKey(email), LOGIN_EMAIL_FALLBACK_RATE_LIMIT.windowMs)
 }
 
 /** 登录成功后清零失败计数 */
 export function clearLoginFailures(email: string, ip: string | null): void {
-  store.delete(loginKey(email, ip))
+  store.reset(loginKey(email, ip))
+  store.reset(loginEmailKey(email))
 }
 
 function sharePasswordKey(ip: string | null): string {
@@ -117,10 +103,10 @@ export function recordSharePasswordFailure(ip: string | null): void {
 
 /** 分享密码校验成功后清零失败计数 */
 export function clearSharePasswordFailures(ip: string | null): void {
-  store.delete(sharePasswordKey(ip))
+  store.reset(sharePasswordKey(ip))
 }
 
 /** 测试辅助：清空整个 store（用例隔离用，生产勿调） */
 export function resetAuthRateLimitStoreForTest(): void {
-  store.clear()
+  store.clearForTest()
 }

package/src/server/middlewares/rate-limit.ts

@@ -1,21 +1,38 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
 import { getRequest } from '@tanstack/react-start/server'
+import { getClientIp } from '@allbluecn/kernel'
+import { createFixedWindowRateLimiter } from '@/server/lib/fixed-window-rate-limit'
 
 // ⚠️ 架构边界：限流状态存于单进程内存（store Map），多实例部署不共享，
 // 实际阈值 = 配置值 × 实例数。本期不实施分布式限流（Redis 等），
 // 多实例部署落地前不得将本模块视为唯一防线。
 
-const store = new Map<string, { count: number; resetAt: number }>()
+// store + 过期清扫定时器收敛到共享实现（2026-10 审计 🔵，与 auth-rate-limit.ts 同源）
+const store = createFixedWindowRateLimiter()
 
-function check(key: string, max: number, windowMs: number): boolean {
-  const now = Date.now()
-  const entry = store.get(key)
-  if (!entry || now > entry.resetAt) {
-    store.set(key, { count: 1, resetAt: now + windowMs })
-    return true
+/** 限流拒绝专用错误类型（2026-10 审计 🟡）：上游可 instanceof 映射 429，
+ * 不再与意外异常混同按 500 处理。message 维持原文，既有 catch 行为不变。 */
+export class RateLimitError extends Error {
+  constructor() {
+    super('Too many requests')
+    this.name = 'RateLimitError'
   }
-  if (entry.count >= max) return false
-  entry.count++
-  return true
 }
 
 export async function checkAuthRateLimit(
@@ -23,9 +40,19 @@ export async function checkAuthRateLimit(
   max = 10,
   windowMs = 15 * 60 * 1000,
 ): Promise<void> {
-  const request = getRequest()
-  const ip = request?.headers?.get('x-forwarded-for') ?? 'unknown'
-  if (!check(`${key}:${ip}`, max, windowMs)) {
-    throw new Error('Too many requests')
+  // getRequest() 在 Start 运行时外（路由 handler 直调的单测等）会 throw
+  // "No StartEvent found"，而非返回 null——按「无请求上下文」同口径归 unknown 桶
+  let request: Request | null = null
+  try {
+    request = getRequest()
+  } catch {
+    request = null
+  }
+  // IP 提取走 kernel getClientIp 可信代理口径（CF-Connecting-IP / X-Real-IP /
+  // XFF 末段）——原始 XFF 整串可被客户端逐请求伪造，每个新值得全新限流桶。
+  // 无请求上下文（getRequest() 为 null/undefined）时归 unknown 桶，仍受限流计数保护。
+  const ip = (request ? getClientIp(request as Request) : null) ?? 'unknown'
+  if (!store.check(`${key}:${ip}`, max, windowMs)) {
+    throw new RateLimitError()
   }
-}
+}