@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/middlewares/security-headers.ts

@@ -103,21 +103,19 @@ function withSecurityHeaders(result: Response, headers: Record<string, string>):
   })
 }
 
-export const securityHeadersMiddleware = createMiddleware().server(async ({ next }: any) => {
+/**
+ * requestMiddleware 管道契约（start-server-core createStartHandler executeMiddleware）：
+ * `next()` 返回 RequestServerResult（终端响应挂在 `.response` 上，非 Response 本体）。
+ * 原实现 `result instanceof Response` 恒 false，全靠 `result?.response || result`
+ * 的 any 兜底才命中；且降级重建分支从 ctx 上取 body/status（恒 undefined/null），
+ * @auth/core 等 immutable headers 场景会产出空 200。现统一先解析出真实 Response
+ * 再走 withSecurityHeaders（body/status 全保真），中间件不再整体重建非 Response 载体。
+ */
+export const securityHeadersMiddleware = createMiddleware().server(async ({ next }) => {
   const headers = buildSecurityHeaders(process.env.NODE_ENV === 'production')
-  const result = await next() as any
-
-  if (result instanceof Response) return withSecurityHeaders(result, headers)
-
-  const carrier: any = result?.response || result
-  const target: Headers | undefined = carrier?.headers
-  if (!target) return result
-
-  const merged = mergeSecurityHeaders(target, headers)
-  if (merged === target) return result
-  return new Response(result?.body ?? null, {
-    status: result?.status ?? 200,
-    statusText: result?.statusText,
-    headers: merged,
-  })
+  const result = await next()
+  const response = result instanceof Response ? result : result.response
+  if (response instanceof Response) return withSecurityHeaders(response, headers)
+  // 无响应载体（异常路径由框架兜底）：原样透传
+  return result
 })

package/src/server/notifications/__tests__/notification-service.test.ts

@@ -13,6 +13,8 @@ vi.mock('@allbluecn/database', () => ({
       findMany: vi.fn(),
       count: vi.fn(),
     },
+    // digest 标题 i18n（审计 🟡）：deliverDueDigests 读 user.locale
+    user: { findUnique: vi.fn() },
   },
   Prisma: {},
 }))
@@ -34,6 +36,7 @@ const mockedNotifCreate = prisma.notification.create as ReturnType<typeof vi.fn>
 const mockedNotifFindFirst = prisma.notification.findFirst as ReturnType<typeof vi.fn>
 const mockedNotifFindMany = prisma.notification.findMany as ReturnType<typeof vi.fn>
 const mockedNotifCount = prisma.notification.count as ReturnType<typeof vi.fn>
+const mockedUserFindUnique = prisma.user.findUnique as ReturnType<typeof vi.fn>
 const mockedEmit = notificationBus.emit as ReturnType<typeof vi.fn>
 
 const realtimePrefs = {
@@ -66,6 +69,7 @@ beforeEach(() => {
   mockedFindUnique.mockResolvedValue(realtimePrefs)
   mockedCreatePref.mockResolvedValue(null)
   mockedNotifCreate.mockResolvedValue(createdNotification)
+  mockedUserFindUnique.mockResolvedValue({ locale: 'zh' })
 })
 
 describe('createNotification frequency 判定', () => {

package/src/server/notifications/notification-service.ts

@@ -12,6 +12,7 @@ import {
   DEFAULT_CATEGORIES,
   DEFAULT_EMAIL_CATEGORIES,
 } from '@allbluecn/kernel'
+import { m } from '@/paraglide/messages.js'
 import { notificationBus } from './event-bus'
 import { checkEmailEligibility } from '../email/preferences'
 import { sendTemplateEmail } from '../email'
@@ -35,13 +36,27 @@ export interface CreateNotificationInput {
   force?: boolean
 }
 
-/** 服务端直出的类别中文名（与 zh locale tabs 保持一致） */
-const CATEGORY_LABELS: Record<NotificationCategory, string> = {
-  team: '团队协作',
-  collaboration: '内容协作',
-  system: '系统公告',
-  billing: '账单订阅',
-  security: '安全告警',
+/** paraglide 显式 locale 选项（照 verify-reminder 先例：en 用户注入 { locale: 'en' }） */
+type DigestMsgOptions = { locale?: 'en' }
+
+/** 类别短标签（i18n，随用户 locale 出 digest 标题；2026-10 审计 🟡：原为服务端
+ * 硬编码中文，英文用户收到中文摘要标题）。零参数消息的 locale 选项须走第二参。 */
+function categoryLabel(
+  category: NotificationCategory,
+  msgOptions?: DigestMsgOptions,
+): string {
+  switch (category) {
+    case 'team':
+      return m.notifications_digest_categoryTeam(undefined, msgOptions)
+    case 'collaboration':
+      return m.notifications_digest_categoryCollaboration(undefined, msgOptions)
+    case 'system':
+      return m.notifications_digest_categorySystem(undefined, msgOptions)
+    case 'billing':
+      return m.notifications_digest_categoryBilling(undefined, msgOptions)
+    case 'security':
+      return m.notifications_digest_categorySecurity(undefined, msgOptions)
+  }
 }
 
 const DIGEST_TYPE: Record<'digest-daily' | 'digest-weekly', string> = {
@@ -93,7 +108,7 @@ export async function getOrCreatePreferences(userId: string): Promise<Notificati
 
 async function insertNotification(
   input: CreateNotificationInput
-): Promise<NotificationItem | null> {
+): Promise<NotificationItem> {
   const created = await prisma.notification.create({
     data: {
       userId: input.userId,
@@ -127,19 +142,22 @@ export async function createNotification(input: CreateNotificationInput): Promis
     if (!input.force && frequency === 'off') return
 
     const item = await insertNotification(input)
-    if (!item) return
 
     if (input.force || frequency === 'realtime') {
       notificationBus.emit(input.userId, { kind: 'notification', notification: item })
       // 邮件镜像（fire-and-forget，不阻塞站内通知）：条件 1-5 在此判定，条件 6（频控）由 outbox 内部执行
-      // .catch 兜底：mirrorToEmail 内部虽有全量 try/catch，此处防未来改动漏出 rejection
-      void mirrorToEmail({
-        userId: input.userId,
-        category: input.category,
-        title: input.title,
-        body: input.body ?? null,
-        link: input.link ?? null,
-      }).catch((e) => {
+      // .catch 兜底：mirrorToEmail 内部虽有全量 try/catch，此处防未来改动漏出 rejection。
+      // prefs 复用上方已查得的偏好（2026-10 审计 🟡：mirrorToEmail 内原重复查询一次）
+      void mirrorToEmail(
+        {
+          userId: input.userId,
+          category: input.category,
+          title: input.title,
+          body: input.body ?? null,
+          link: input.link ?? null,
+        },
+        prefs,
+      ).catch((e) => {
         console.error('[notifications] mirror to email failed (unhandled rejection):', e)
       })
     }
@@ -151,23 +169,26 @@ export async function createNotification(input: CreateNotificationInput): Promis
 /**
  * 站内通知镜像到邮件（六条件链）。任何失败只记日志不抛出，不阻断站内通知。
  * 条件 1（force/realtime）由调用方判定；条件 2/3/4/5 在此判定；条件 6（频控）由 outbox 内部执行。
+ * prefs 由调用方传入（createNotification 刚查过同一份，避免重复 DB 往返）。
  */
-async function mirrorToEmail(input: {
-  userId: string
-  category: NotificationCategory
-  title: string
-  body: string | null
-  link: string | null
-}): Promise<void> {
+async function mirrorToEmail(
+  input: {
+    userId: string
+    category: NotificationCategory
+    title: string
+    body: string | null
+    link: string | null
+  },
+  prefs: NotificationPreferences,
+): Promise<void> {
   try {
     // 条件 2：邮件渠道开关（通知偏好里该类别的 emailCategories 需开启）
-    const prefs = await getOrCreatePreferences(input.userId)
     if (!prefs.emailCategories[input.category]) return
 
     // 条件 4：邮箱已验证（User.email 存在且 emailVerified 非空）
     const user = await prisma.user.findUnique({
       where: { id: input.userId },
-      select: { email: true, emailVerified: true, locale: true },
+      select: { email: true, emailVerified: true, locale: true, timezone: true },
     })
     if (!user?.email || !user.emailVerified) return
 
@@ -175,9 +196,12 @@ async function mirrorToEmail(input: {
     const eligibility = await checkEmailEligibility(input.userId, 'notification')
     if (!eligibility.sendable) return
 
-    // 条件 5：DND 时段外（复用内核 isInDndWindow，已处理跨零点区间）
+    // 条件 5：DND 时段外（复用内核 isInDndWindow，已处理跨零点区间）。
+    // now 取用户时区本地时间（2026-10 审计 🟡：原按服务器时区解释，UTC 服务器上
+    // +08 用户的免打扰完全错位）；timezone 缺失/非法回落服务器本地时间（原行为）。
     const now = new Date()
-    const hhmm = `${String(now.getHours()).padStart(2, '0')}:${String(now.getMinutes()).padStart(2, '0')}`
+    const hhmm =
+      (user.timezone ? hhmmInTimeZone(now, user.timezone) : null) ?? serverLocalHhmm(now)
     if (isInDndWindow(prefs, hhmm)) return
 
     await sendTemplateEmail({
@@ -197,14 +221,50 @@ async function mirrorToEmail(input: {
   }
 }
 
-function formatDigestBody(titles: string[], total: number): string {
+/** 服务器本地 HH:MM（timezone 缺失时的原行为回落） */
+function serverLocalHhmm(date: Date): string {
+  return `${String(date.getHours()).padStart(2, '0')}:${String(date.getMinutes()).padStart(2, '0')}`
+}
+
+/**
+ * 用户时区本地 HH:MM（Intl 全 ICU，Node 24 / 浏览器均内置；零新依赖）。
+ * 时区标识非法（Intl 抛 RangeError）返回 null 交由调用方回落。
+ */
+export function hhmmInTimeZone(date: Date, timeZone: string): string | null {
+  try {
+    const parts = new Intl.DateTimeFormat('en-US', {
+      timeZone,
+      hour: '2-digit',
+      minute: '2-digit',
+      hourCycle: 'h23',
+    }).formatToParts(date)
+    const get = (type: string) => parts.find((p) => p.type === type)?.value ?? ''
+    const hour = get('hour')
+    const minute = get('minute')
+    if (!hour || !minute) return null
+    return `${hour === '24' ? '00' : hour}:${minute}`
+  } catch {
+    return null
+  }
+}
+
+function formatDigestBody(
+  titles: string[],
+  total: number,
+  msgOptions?: DigestMsgOptions,
+): string {
   const lines = titles.slice(0, DIGEST_SUMMARY_ITEMS).map((t) => `· ${t}`)
   if (total > DIGEST_SUMMARY_ITEMS) {
-    lines.push(`等 ${total} 条通知`)
+    lines.push(m.notifications_digest_more({ count: total }, msgOptions))
   }
   return lines.join('\n')
 }
 
+/** digest 生成进程内互斥闸（2026-10 审计 🟡：水位线 check-then-act 无锁，并发 SSE
+ * 连接——多标签页/快速重连——可对同类别重复出摘要）。同 (userId, category, type)
+ * 摘要生成期互斥；多 isolate 部署各持一份（与 event-bus 单进程边界同口径）。 */
+const inFlightDigests = new Set<string>()
+
 /**
  * 检查并投递到期的 digest（摘要）通知。在用户建立 SSE 连接时调用（fire-and-forget）：
  * 以同类别最近一条同频率摘要的 createdAt 为水位线，积压通知数 > 0 且距上次摘要超过
@@ -213,6 +273,12 @@ function formatDigestBody(titles: string[], total: number): string {
 export async function deliverDueDigests(userId: string): Promise<void> {
   try {
     const prefs = await getOrCreatePreferences(userId)
+    // i18n 对齐（2026-10 审计 🟡）：照 notifyDrafted/notifyEnvIssue 先例按 user.locale 消费 paraglide
+    const user = await prisma.user.findUnique({
+      where: { id: userId },
+      select: { locale: true },
+    })
+    const msgOptions = user?.locale === 'en' ? { locale: 'en' as const } : undefined
     const digestCats = (Object.keys(prefs.categories) as NotificationCategory[]).filter(
       (c) => prefs.categories[c] === 'digest-daily' || prefs.categories[c] === 'digest-weekly'
     )
@@ -223,47 +289,66 @@ export async function deliverDueDigests(userId: string): Promise<void> {
       digestCats.map(async (category) => {
         const frequency = prefs.categories[category] as 'digest-daily' | 'digest-weekly'
         const type = DIGEST_TYPE[frequency]
+        const inFlightKey = `${userId}:${category}:${type}`
+        if (inFlightDigests.has(inFlightKey)) return null
+        inFlightDigests.add(inFlightKey)
+        try {
+          const lastDigest = await prisma.notification.findFirst({
+            where: { userId, category, type },
+            orderBy: { createdAt: 'desc' },
+            select: { createdAt: true },
+          })
+          if (
+            lastDigest &&
+            Date.now() - lastDigest.createdAt.getTime() < DIGEST_MIN_INTERVAL_MS[frequency]
+          ) {
+            return null
+          }
 
-        const lastDigest = await prisma.notification.findFirst({
-          where: { userId, category, type },
-          orderBy: { createdAt: 'desc' },
-          select: { createdAt: true },
-        })
-        if (lastDigest && Date.now() - lastDigest.createdAt.getTime() < DIGEST_MIN_INTERVAL_MS[frequency]) {
-          return null
-        }
-
-        const since = lastDigest?.createdAt ?? new Date(0)
-        const pendingWhere = {
-          userId,
-          category,
-          type: { not: { startsWith: 'digest.' } },
-          createdAt: { gt: since },
+          const since = lastDigest?.createdAt ?? new Date(0)
+          const pendingWhere = {
+            userId,
+            category,
+            type: { not: { startsWith: 'digest.' } },
+            createdAt: { gt: since },
+          }
+          const [pendingCount, recent] = await Promise.all([
+            prisma.notification.count({ where: pendingWhere }),
+            prisma.notification.findMany({
+              where: pendingWhere,
+              orderBy: { createdAt: 'desc' },
+              select: { title: true },
+              take: DIGEST_SUMMARY_ITEMS,
+            }),
+          ])
+          if (pendingCount === 0) return null
+          return { category, frequency, type, pendingCount, recent }
+        } finally {
+          inFlightDigests.delete(inFlightKey)
         }
-        const [pendingCount, recent] = await Promise.all([
-          prisma.notification.count({ where: pendingWhere }),
-          prisma.notification.findMany({
-            where: pendingWhere,
-            orderBy: { createdAt: 'desc' },
-            select: { title: true },
-            take: DIGEST_SUMMARY_ITEMS,
-          }),
-        ])
-        if (pendingCount === 0) return null
-        return { category, frequency, type, pendingCount, recent }
       }),
     )
 
     // 写入保持串行（总线推送顺序与原实现一致）
     for (const item of pending) {
       if (!item) continue
-      const periodLabel = item.frequency === 'digest-daily' ? '今日' : '本周'
+      const label = categoryLabel(item.category, msgOptions)
+      const title =
+        item.frequency === 'digest-daily'
+          ? m.notifications_digest_titleDaily(
+              { category: label, count: item.pendingCount },
+              msgOptions,
+            )
+          : m.notifications_digest_titleWeekly(
+              { category: label, count: item.pendingCount },
+              msgOptions,
+            )
       await createNotification({
         userId,
         category: item.category,
         type: item.type,
-        title: `${periodLabel}${CATEGORY_LABELS[item.category]}有 ${item.pendingCount} 条新通知`,
-        body: formatDigestBody(item.recent.map((n) => n.title), item.pendingCount),
+        title,
+        body: formatDigestBody(item.recent.map((n) => n.title), item.pendingCount, msgOptions),
         force: true,
       })
     }

package/src/server/notifications/verify-reminder.ts

@@ -29,6 +29,8 @@ export async function ensureVerifyReminder(userId: string): Promise<void> {
     })
     if (!user || user.emailVerified) return
 
+    // check-then-act 并发窗口（2026-10 审计 ⚪，声明取舍）：多端同时登录可双写
+    // 重复提醒通知；窗口极小且重复提醒无资损/越权面，容忍现状不引入仲裁开销。
     const existing = await prisma.notification.findFirst({
       where: { userId, type: REMINDER_TYPE },
       select: { id: true },

package/src/server/permissions.ts

@@ -17,6 +17,10 @@ const levelRank: Record<PermissionLevel, number> = {
   admin: 3,
 }
 
+/** OSS no-op warn-once（2026-10 审计 🟠：requirePermission 缺 pro 服务时整体
+ * 放行是 OSS 部署的既定语义，但调用方若将其当安全边界即失效——显式留痕） */
+let warnedNoPermissionService = false
+
 export async function requirePermission(
   userId: string,
   resource: string,
@@ -24,11 +28,23 @@ export async function requirePermission(
   minLevel: PermissionLevel = 'write',
 ): Promise<void> {
   const service = getProService('permissions')
-  if (!service) return
+  if (!service) {
+    if (!warnedNoPermissionService) {
+      warnedNoPermissionService = true
+      console.warn(
+        '[permissions] 权限服务未接入（OSS 部署）：requirePermission 直接放行，' +
+          '不构成安全边界。资源级属主/成员校验必须由调用方（serverFn）自行承担。',
+      )
+    }
+    return
+  }
 
   const assignmentCount = await prisma.roleAssignment.count({ where: { userId } })
   let level: PermissionLevel
   if (assignmentCount === 0) {
+    // 「无指派默认 write」语义（2026-10 审计 🟠 待决策）：RBAC 可选设计下
+    // 未配置角色的用户默认全员可写；给用户添加角色只会按 service.checkPermission
+    // 收敛。降为 read/none 是行为破坏性变更，需产品决策（见审计报告）。
     const user = await prisma.user.findUnique({
       where: { id: userId },
       select: { role: true },

package/src/{lib → server}/rag.ts

@@ -12,6 +12,8 @@
 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 // GNU Affero General Public License for more details.
 //
+// ⚠ SERVER-ONLY：本模块经 @/server/ai-gateway 挂入 prisma 链，禁止客户端组件 import
+// （原置于 src/lib 同构目录，客户端误引即把服务端依赖拉进浏览器 bundle，审计 🟡 迁出）。
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
@@ -21,7 +23,7 @@ import {
   rerankCandidates,
   RECALL_MULTIPLIER,
 } from "@/server/ai-gateway"
-import { getVectorStore } from "./vector-store"
+import { getVectorStore } from "@/lib/vector-store"
 
 export async function indexDocument(
   docId: string,

package/src/server/references/access.ts

@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 引用实体的归属断言（审计 A2x-serverfns-5 🟠 2026-10-25）：
+// references engine（@/server/references/engine）按 moduleRegistry 开发者配置
+// 直查各实体表，无任何用户维度过滤——serverFn 层（create/resolve/search）必须
+// 先经本模块收敛结果集，否则任意登录用户可对他人实体建引用、枚举引用关系、
+// 关键词全站检索。
+//
+// FAIL-CLOSED：仅登记了归属谓词的模块可访问。kernel 注册的新模块（含
+// anyhub / prototype 这类表尚未落地或无属主列的实体）在补谓词前一律拒绝；
+// 接入新模块时必须同步在 resolveAccessSpec 补归属谓词。
+
+import { getPrisma } from '@allbluecn/database/get-prisma'
+
+type AccessSpec =
+  | { kind: 'designs' }
+  | { kind: 'design_pages' }
+  | { kind: 'designs_or_pages' }
+  | { kind: 'denied' }
+
+function resolveAccessSpec(module: string, entityType?: string): AccessSpec {
+  if (module !== 'design') return { kind: 'denied' }
+  if (entityType === 'design_document') return { kind: 'designs' }
+  if (entityType === 'design_page') return { kind: 'design_pages' }
+  // entityType 未传（resolve/search 的结果行不带 type）：design 模块下
+  // designs / design_pages 两谓词取并集，避免误杀合法引用目标
+  return { kind: 'designs_or_pages' }
+}
+
+/**
+ * 返回 entityIds 中当前用户可见（属主）的 id 集合。
+ * 用于 search 结果过滤与单个实体的归属断言（配合 assertEntityAccessible）。
+ */
+export async function filterAccessibleEntityIds(
+  userId: string,
+  module: string,
+  entityIds: string[],
+  entityType?: string,
+): Promise<Set<string>> {
+  const ids = [...new Set(entityIds)].filter(Boolean)
+  if (ids.length === 0) return new Set()
+  const spec = resolveAccessSpec(module, entityType)
+  const prisma = await getPrisma()
+  const accessible = new Set<string>()
+
+  if (spec.kind === 'designs' || spec.kind === 'designs_or_pages') {
+    const rows = await prisma.design.findMany({
+      where: { id: { in: ids }, userId, isDeleted: false },
+      select: { id: true },
+    })
+    for (const r of rows) accessible.add(r.id)
+  }
+  if (spec.kind === 'design_pages' || spec.kind === 'designs_or_pages') {
+    const rows = await prisma.designPage.findMany({
+      where: { id: { in: ids }, design: { userId, isDeleted: false } },
+      select: { id: true },
+    })
+    for (const r of rows) accessible.add(r.id)
+  }
+  return accessible
+}
+
+/** 单实体归属断言：不可访问（不存在/他人/未登记模块）抛错 */
+export async function assertEntityAccessible(
+  userId: string,
+  module: string,
+  entityId: string,
+  entityType?: string,
+): Promise<void> {
+  const accessible = await filterAccessibleEntityIds(userId, module, [entityId], entityType)
+  if (!accessible.has(entityId)) {
+    throw new Error('引用实体不存在或无权限')
+  }
+}
+
+/** 过滤 (module, entityId) 引用列表，仅保留当前用户可访问的条目 */
+export async function filterAccessibleRefs<T extends { module: string; entityId: string; type?: string }>(
+  userId: string,
+  refs: T[],
+): Promise<T[]> {
+  const byKey = new Map<string, T[]>()
+  for (const ref of refs) {
+    const key = `${ref.module}\u0000${ref.type ?? ''}`
+    const list = byKey.get(key)
+    if (list) list.push(ref)
+    else byKey.set(key, [ref])
+  }
+  const kept = new Set<T>()
+  for (const [key, group] of byKey) {
+    const [module, type] = key.split('\u0000')
+    const accessible = await filterAccessibleEntityIds(
+      userId,
+      module!,
+      group.map((g) => g.entityId),
+      type || undefined,
+    )
+    for (const g of group) {
+      if (accessible.has(g.entityId)) kept.add(g)
+    }
+  }
+  return refs.filter((r) => kept.has(r))
+}

package/src/server/references/engine.ts

@@ -92,32 +92,51 @@ export async function searchReferences(
     ? searchConfigs.filter(c => types.includes(c.module) || types.includes(c.type))
     : searchConfigs
 
-  const results: SearchResult[] = []
-  for (const config of filtered) {
-    const mod = moduleRegistry.getModule(config.module)
-    if (!mod) continue
-    const { prisma: p } = await import("@allbluecn/database")
-    try {
-      // SEC-14：全部标识符断言通过才拼接，任一非法即 throw → catch 跳过该模块
-      const table = assertSafeIdent(mod.entities[0].table, "table")
-      const fields = config.fields.map((f) => assertSafeIdent(f, "searchField")).join(", ")
-      const searchField = assertSafeIdent(config.fields[0], "searchField")
-      const rows = await p.$queryRawUnsafe<Record<string, unknown>[]>(
-        `SELECT id, ${fields} FROM \`${table}\` WHERE \`${searchField}\` LIKE ? LIMIT 20`,
-        `%${query}%`
-      )
-      for (const row of rows) {
-        const display = mod.referenceDisplay(config.type, row)
-        results.push({
-          id: row.id as string,
-          module: config.module,
-          type: config.type,
-          title: display.title,
-          status: display.status,
-          url: display.url,
-        })
+  // LIKE 元字符转义（2026-10 审计 🟡：query 中的 %/_ 会作为通配符产生意外宽匹配；
+  // 参数化已防注入，这里只修搜索语义）。ESCAPE '\\' 在 psql（standard_conforming_strings
+  // 默认 on）与 sqlite 下均为单反斜杠转义符。
+  const likePattern = `%${query
+    .replaceAll("\\", "\\\\")
+    .replaceAll("%", "\\%")
+    .replaceAll("_", "\\_")}%`
+
+  // 模块间并行（2026-10 审计 🟡：for-await 串行逐模块，模块多时墙钟线性累加）
+  const settled = await Promise.all(
+    filtered.map(async (config): Promise<SearchResult[]> => {
+      const mod = moduleRegistry.getModule(config.module)
+      if (!mod) return []
+      const { prisma: p } = await import("@allbluecn/database")
+      try {
+        // SEC-14：全部标识符断言通过才拼接，任一非法即 throw → catch 跳过该模块。
+        // 表名按 config.type 匹配模块内 entity（2026-10 审计 🟡：entities[0] 与
+        // type 可能错位，搜索落到错误表上），未命中回落首 entity 兼容旧配置。
+        const entity =
+          mod.entities.find((e) => e.type === config.type) ?? mod.entities[0]
+        const table = assertSafeIdent(entity.table, "table")
+        const fields = config.fields.map((f) => assertSafeIdent(f, "searchField")).join(", ")
+        const searchField = assertSafeIdent(config.fields[0], "searchField")
+        const rows = await p.$queryRawUnsafe<Record<string, unknown>[]>(
+          `SELECT id, ${fields} FROM \`${table}\` WHERE \`${searchField}\` LIKE ? ESCAPE '\\' LIMIT 20`,
+          likePattern
+        )
+        const results: SearchResult[] = []
+        for (const row of rows) {
+          const display = mod.referenceDisplay(config.type, row)
+          results.push({
+            id: row.id as string,
+            module: config.module,
+            type: config.type,
+            title: display.title,
+            status: display.status,
+            url: display.url,
+          })
+        }
+        return results
+      } catch {
+        // skip tables that don't exist yet / 非法标识符配置
+        return []
       }
-    } catch { /* skip tables that don't exist yet / 非法标识符配置 */ }
-  }
-  return results
+    })
+  )
+  return settled.flat()
 }

package/src/server/remote-auth.ts

@@ -20,10 +20,16 @@ export async function readRemoteAuth(): Promise<RemoteAuthData | null> {
   }
 }
 
+// 写入防御（2026-10 审计 🟢：原 invoke 无 try/catch，rejection 完全依赖调用方兜底，
+// 与 readRemoteAuth 的防御风格不一致——本地持久化失败不应反噬登录/登出主流程）
 export async function writeRemoteAuth(token: string, sessionToken?: string): Promise<void> {
   if (process.env.DEPLOY_TARGET !== 'desktop') return
   const { invoke } = await import('@tauri-apps/api/core')
-  await invoke('write_remote_auth', { token, sessionToken })
+  try {
+    await invoke('write_remote_auth', { token, sessionToken })
+  } catch (e) {
+    console.warn('[remote-auth] write_remote_auth 失败（本地权益态未更新）:', e instanceof Error ? e.message : String(e))
+  }
 }
 
 export async function writeRemoteSession(
@@ -33,13 +39,21 @@ export async function writeRemoteSession(
 ): Promise<void> {
   if (process.env.DEPLOY_TARGET !== 'desktop') return
   const { invoke } = await import('@tauri-apps/api/core')
-  await invoke('write_remote_session', { userId, planName, sessionToken })
+  try {
+    await invoke('write_remote_session', { userId, planName, sessionToken })
+  } catch (e) {
+    console.warn('[remote-auth] write_remote_session 失败（本地会话态未更新）:', e instanceof Error ? e.message : String(e))
+  }
 }
 
 export async function clearRemoteAuth(): Promise<void> {
   if (process.env.DEPLOY_TARGET !== 'desktop') return
   const { invoke } = await import('@tauri-apps/api/core')
-  await invoke('clear_remote_auth')
+  try {
+    await invoke('clear_remote_auth')
+  } catch (e) {
+    console.warn('[remote-auth] clear_remote_auth 失败（本地态可能残留）:', e instanceof Error ? e.message : String(e))
+  }
 }
 
 export async function openLoginUrl(loginUrl: string): Promise<void> {