@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/resources.ts

@@ -121,7 +121,7 @@ export async function getResourceSnapshots(
 ): Promise<ResourceSnapshots> {
   const licensed = await verifyActiveLicense()
   const session = await requireAuth(request)
-  const userId = session.user!.id!
+  const userId = session.user.id
   let limits: PlanLimits | null
   let addonSeats = 0
   let seatLimit: number | 'unlimited' = 'unlimited'
@@ -133,7 +133,10 @@ export async function getResourceSnapshots(
       select: PLAN_LIMIT_SELECT,
     })
     limits = (ent as PlanLimits | null) ?? null
-    seatLimit = licensed.license.seats
+    // 席位口径对齐 requireTeamSeats（2026-10 审计 🟠）：licensed 用户执行层恒
+    // unlimited，快照此前显示 license.seats 与执行背离（显示与拦截两套口径）。
+    seatLimit = 'unlimited'
+    guestSeatLimit = 'unlimited'
   } else {
     const resolved = await resolveAccountPlanLimits(userId)
     limits = resolved.limits
@@ -154,12 +157,22 @@ export async function getResourceSnapshots(
   const galleryStorageLimit =
     limits?.galleryStorageMb == null ? 'unlimited' : limits.galleryStorageMb
 
-  const [seatUsage, guestSeatUsage] = await Promise.all([
-    prisma.teamMembership.count({
-      where: { ownerId: userId },
+  // 席位口径与 requireTeamSeats 对齐（2026-10 审计 🟠：原实现 member 快照把 guest
+  // 成员计入、guest 快照漏计已接受的 guest 成员且把 member 邀请计入——进度条虚高/
+  // 漏计）。usage = 同 seatType 成员数 + 同 seatType 待接受邀请数。
+  const [
+    memberSeatUsage,
+    guestSeatUsage,
+    memberPendingInvites,
+    guestPendingInvites,
+  ] = await Promise.all([
+    prisma.teamMembership.count({ where: { ownerId: userId, seatType: 'member' } }),
+    prisma.teamMembership.count({ where: { ownerId: userId, seatType: 'guest' } }),
+    prisma.teamInvitation.count({
+      where: { ownerId: userId, seatType: 'member', status: { in: ['pending', 'pending_approval'] } },
     }),
     prisma.teamInvitation.count({
-      where: { ownerId: userId, status: { in: ['pending', 'pending_approval'] } },
+      where: { ownerId: userId, seatType: 'guest', status: { in: ['pending', 'pending_approval'] } },
     }),
   ])
 
@@ -173,7 +186,9 @@ export async function getResourceSnapshots(
   })
 
   // 画廊存储：GenerationRun.artifacts 持久化的 blob size 汇总（MB）
-  // 简化实现：统计 GenerationRun 数量作为代理指标（实际应查对象存储大小）
+  // ⚠ 已知口径错位（2026-10 审计 🟡）：usage 统计的是 GenerationRun 条数（代理指标），
+  // 与 limit 的 MB 量纲不可比。**禁止把该 key 接入 requireResource 强制路径**——
+  // 接入即「500 次生成触顶」假配额。真实化需对象存储侧汇总 blob 大小（待决策）。
   const galleryStorageUsage = await prisma.generationRun.count({
     where: {
       userId,
@@ -182,47 +197,38 @@ export async function getResourceSnapshots(
     },
   })
 
+  // 快照余量查询并行化（2026-10 审计 ⚪：原实现返回字面量内 7 个 await 串行累加墙钟）
+  const [
+    workspaceUsage,
+    aiQuotaUsage,
+    agentUsage,
+    skillUsage,
+    sandboxDurationMsSum,
+  ] = await Promise.all([
+    prisma.workspace.count({ where: { ownerId: userId } }),
+    prisma.aiUsageLog.count({
+      where: { userId, source: 'hosted', createdAt: { gte: startOfCurrentMonth() } },
+    }),
+    prisma.userAgent.count({ where: { userId, isDeleted: false } }),
+    prisma.userSkill.count({ where: { userId, isDeleted: false } }),
+    prisma.aiUsageLog.aggregate({
+      _sum: { durationMs: true },
+      where: { userId, activity: 'sandbox', createdAt: { gte: startOfCurrentMonth() } },
+    }),
+  ])
+
   return {
-    seats: { limit: seatLimit, usage: seatUsage },
-    guestSeats: { limit: guestSeatLimit, usage: guestSeatUsage },
-    workspaces: {
-      limit: workspaceLimit,
-      usage: await prisma.workspace.count({ where: { ownerId: userId } }),
-    },
-    aiQuotaMonthly: {
-      limit: aiLimit,
-      usage: await prisma.aiUsageLog.count({
-        where: {
-          userId,
-          source: 'hosted',
-          createdAt: { gte: startOfCurrentMonth() },
-        },
-      }),
-    },
-    agentQuota: {
-      limit: agentLimit,
-      usage: await prisma.userAgent.count({
-        where: { userId, isDeleted: false },
-      }),
-    },
-    skillQuota: {
-      limit: skillLimit,
-      usage: await prisma.userSkill.count({ where: { userId, isDeleted: false } }),
-    },
+    seats: { limit: seatLimit, usage: memberSeatUsage + memberPendingInvites },
+    guestSeats: { limit: guestSeatLimit, usage: guestSeatUsage + guestPendingInvites },
+    workspaces: { limit: workspaceLimit, usage: workspaceUsage },
+    aiQuotaMonthly: { limit: aiLimit, usage: aiQuotaUsage },
+    agentQuota: { limit: agentLimit, usage: agentUsage },
+    skillQuota: { limit: skillLimit, usage: skillUsage },
     // 沙箱时长按分钟计（不是次数）：AiUsageLog.activity='sandbox' 的 durationMs 求和后
     // 向上取整——不足一分钟也算一分钟，避免「每次 30 秒、跑两次」绕过配额。
     sandboxMinutesMonthly: {
       limit: sandboxMinutesLimit,
-      usage: Math.ceil(
-        (await prisma.aiUsageLog.aggregate({
-          _sum: { durationMs: true },
-          where: {
-            userId,
-            activity: 'sandbox',
-            createdAt: { gte: startOfCurrentMonth() },
-          },
-        }))._sum.durationMs ?? 0
-      ) / 60_000,
+      usage: Math.ceil(sandboxDurationMsSum._sum.durationMs ?? 0) / 60_000,
     },
     mediaGenerationsMonthly: {
       limit: mediaGenerationsLimit,
@@ -235,6 +241,12 @@ export async function getResourceSnapshots(
   }
 }
 
+/**
+ * 配额预检（统计口径）。⚠ TOCTOU 边界（2026-10 审计 🟡，声明取舍）：快照检查与
+ * 调用方后续写入之间存在窗口，并发请求可集体通过检查超出配额——本函数是**统计性
+ * 预检**而非硬闸，关键资源（席位）的强约束由 requireTeamSeats 的调用方事务内
+ * 条件聚合兜底。需要强一致配额的资源必须在写入事务内以条件聚合复核。
+ */
 export async function requireResource(
   request: Request | undefined,
   resource: keyof ResourceSnapshots,

package/src/server/serverFns/__tests__/auth-server-schemas.test.ts

@@ -27,6 +27,7 @@ const mockUserUpdate = vi.fn().mockResolvedValue({})
 const mockTokenFindUnique = vi.fn()
 const mockTokenCreate = vi.fn().mockResolvedValue({})
 const mockTokenUpdate = vi.fn().mockResolvedValue({})
+const mockTokenUpdateMany = vi.fn().mockResolvedValue({ count: 1 })
 const mockTxRun = vi.fn().mockResolvedValue([])
 const mockSendTemplateEmail = vi.fn().mockResolvedValue({ sent: true })
 const mockBcryptHash = vi.fn().mockResolvedValue('hashed')
@@ -41,8 +42,17 @@ vi.mock('@allbluecn/database', () => ({
       findUnique: (...a: unknown[]) => mockTokenFindUnique(...a),
       create: (...a: unknown[]) => mockTokenCreate(...a),
       update: (...a: unknown[]) => mockTokenUpdate(...a),
+      updateMany: (...a: unknown[]) => mockTokenUpdateMany(...a),
+    },
+    // resetPasswordFn 用交互式事务：回调内以同一组 mock 组装 tx，
+    // await 回调让拒绝向上传播（防孤儿 rejected promise）
+    $transaction: async (fn: (tx: unknown) => Promise<unknown>) => {
+      mockTxRun()
+      return await fn({
+        user: { update: (...a: unknown[]) => mockUserUpdate(...a) },
+        passwordResetToken: { updateMany: (...a: unknown[]) => mockTokenUpdateMany(...a) },
+      })
     },
-    $transaction: (...a: unknown[]) => mockTxRun(...a),
   },
 }))
 
@@ -56,7 +66,11 @@ vi.mock('@/server/middlewares/rate-limit', () => ({
 
 vi.mock('crypto', () => ({
   randomBytes: () => ({ toString: () => 'tok' }),
-  default: { randomBytes: () => ({ toString: () => 'tok' }) },
+  createHash: () => ({ update: () => ({ digest: () => 'hashed-token' }) }),
+  default: {
+    randomBytes: () => ({ toString: () => 'tok' }),
+    createHash: () => ({ update: () => ({ digest: () => 'hashed-token' }) }),
+  },
 }))
 
 vi.mock('bcryptjs', () => ({
@@ -90,8 +104,9 @@ describe('forgotPasswordFn 邮箱归一化', () => {
       locale: null,
     })
     await forgotPasswordFn({ data: { email: 'ALICE@X.COM' } })
+    // DB 只落 sha256(token)（fake createHash → 'hashed-token'），邮件仍发明文 tok
     expect(mockTokenCreate).toHaveBeenCalledWith({
-      data: expect.objectContaining({ token: 'tok', userId: 'u1' }),
+      data: expect.objectContaining({ token: 'hashed-token', userId: 'u1' }),
     })
     expect(mockSendTemplateEmail).toHaveBeenCalledWith(
       expect.objectContaining({
@@ -127,7 +142,8 @@ describe('resetPasswordFn 密码强度', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockTokenFindUnique.mockResolvedValue(null)
-    mockTxRun.mockResolvedValue([])
+    mockTokenUpdateMany.mockResolvedValue({ count: 1 })
+    mockTxRun.mockResolvedValue(undefined)
     mockBcryptHash.mockResolvedValue('hashed')
   })
 
@@ -144,7 +160,7 @@ describe('resetPasswordFn 密码强度', () => {
     )
   })
 
-  it('字母+数字密码 → 通过校验并重置', async () => {
+  it('字母+数字密码 → 通过校验并重置（token 条件 claim 占位）', async () => {
     mockTokenFindUnique.mockResolvedValue({
       id: 'rt1',
       userId: 'u1',
@@ -153,16 +169,42 @@ describe('resetPasswordFn 密码强度', () => {
     })
     await expect(
       resetPasswordFn({ data: { token: 't', password: 'abc12345' } }),
-    ).resolves.toEqual({ message: 'Password reset successfully' })
+    ).resolves.toEqual({ message: '密码重置成功' })
     expect(mockBcryptHash).toHaveBeenCalledWith('abc12345', 12)
     expect(mockTxRun).toHaveBeenCalledTimes(1)
     expect(mockUserUpdate).toHaveBeenCalledWith({
       where: { id: 'u1' },
-      data: { password: 'hashed' },
+      // tokenVersion increment：重置密码吊销既有 JWT 会话（双端 auth callback 比对）
+      data: { password: 'hashed', tokenVersion: { increment: 1 } },
     })
-    expect(mockTokenUpdate).toHaveBeenCalledWith({
-      where: { id: 'rt1' },
+    expect(mockTokenUpdateMany).toHaveBeenCalledWith({
+      where: { id: 'rt1', usedAt: null },
       data: { usedAt: expect.any(Date) },
     })
   })
+
+  it('token 已被并发 claim（count=0）→ 拒绝且不改密码', async () => {
+    mockTokenFindUnique.mockResolvedValue({
+      id: 'rt1',
+      userId: 'u1',
+      usedAt: null,
+      expiresAt: FUTURE,
+    })
+    mockTokenUpdateMany.mockResolvedValue({ count: 0 })
+    await expect(
+      resetPasswordFn({ data: { token: 't', password: 'abc12345' } }),
+    ).rejects.toThrow(/已使用/)
+    expect(mockUserUpdate).not.toHaveBeenCalled()
+  })
+
+  it('查询按 sha256(token) hash 而非明文', async () => {
+    mockTokenFindUnique.mockResolvedValue(null)
+    await expect(
+      resetPasswordFn({ data: { token: 't', password: 'abc12345' } }),
+    ).rejects.toThrow(/无效或已过期/)
+    expect(mockTokenFindUnique).toHaveBeenCalledWith({
+      where: { token: 'hashed-token' },
+      select: { id: true, userId: true, usedAt: true, expiresAt: true },
+    })
+  })
 })

package/src/server/serverFns/__tests__/collab.test.ts

@@ -34,6 +34,7 @@ const mocks = vi.hoisted(() => ({
   isSharePasswordBlocked: vi.fn(),
   recordSharePasswordFailure: vi.fn(),
   clearSharePasswordFailures: vi.fn(),
+  checkAuthRateLimit: vi.fn(),
 }));
 
 vi.mock("@tanstack/react-start", () => ({
@@ -102,6 +103,10 @@ vi.mock("@/server/middlewares/auth-rate-limit", () => ({
   clearSharePasswordFailures: mocks.clearSharePasswordFailures,
 }));
 
+vi.mock("@/server/middlewares/rate-limit", () => ({
+  checkAuthRateLimit: mocks.checkAuthRateLimit,
+}));
+
 vi.mock("@/lib/session", () => ({
   getCurrentSession: mocks.getCurrentSession,
 }));
@@ -141,6 +146,7 @@ beforeEach(() => {
   mocks.isSharePasswordBlocked.mockReturnValue(false);
   mocks.recordSharePasswordFailure.mockReturnValue(undefined);
   mocks.clearSharePasswordFailures.mockReturnValue(undefined);
+  mocks.checkAuthRateLimit.mockResolvedValue(undefined);
 });
 
 afterEach(() => {
@@ -275,6 +281,21 @@ describe("createCollabTicketFn", () => {
 });
 
 describe("createSharePresenceTicketFn", () => {
+  it("签发前按 IP 频控（checkAuthRateLimit），被拒时不查询 share", async () => {
+    mocks.getCurrentSession.mockResolvedValue(null);
+    mocks.checkAuthRateLimit.mockRejectedValue(new Error("Too many requests"));
+
+    await expect(
+      createSharePresenceTicketFn({ data: { shareToken: "tokABC" } }),
+    ).rejects.toThrow("Too many requests");
+    expect(mocks.checkAuthRateLimit).toHaveBeenCalledWith(
+      "collabShareTicket",
+      30,
+      60_000,
+    );
+    expect(mocks.shareFindUnique).not.toHaveBeenCalled();
+  });
+
   it("未登录 + 有效无密码 Share → guest ticket（sub 前缀 guest:、kind/role/room、name 兜底「访客」）", async () => {
     mocks.getCurrentSession.mockResolvedValue(null);
     mocks.shareFindUnique.mockResolvedValue(

package/src/server/serverFns/__tests__/compliance.test.ts

@@ -1,5 +1,9 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 
+const rateLimit = vi.hoisted(() => ({
+  checkRateLimit: vi.fn().mockReturnValue({ allowed: true }),
+}))
+
 vi.mock('@tanstack/react-start', () => ({
   createServerFn: (config: any) => {
     const api: any = {
@@ -27,8 +31,8 @@ vi.mock('@tanstack/react-start/server', () => ({
   getRequest: () => ({}),
 }))
 
-vi.mock('@/lib/pacer', () => ({
-  checkRateLimit: vi.fn().mockReturnValue({ allowed: true }),
+vi.mock('@/server/middlewares/rate-limit-server-fn', () => ({
+  checkRateLimit: rateLimit.checkRateLimit,
 }))
 
 vi.mock('@/server/auth-helpers', () => ({
@@ -85,6 +89,7 @@ function setProBilling(value: unknown) {
 describe('compliance serverFn 三路径权益门控', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    rateLimit.checkRateLimit.mockReturnValue({ allowed: true })
     services.set('license', null)
     setProCompliance(null)
     setProBilling(null)
@@ -135,4 +140,28 @@ describe('compliance serverFn 三路径权益门控', () => {
     expect(deleted).toEqual({ id: 'job-2' })
     expect(mocks.createDeleteJob).toHaveBeenCalledWith('user', 'u1', 'u1')
   })
+
+  it('删除任务频控：1 小时窗口内重复提交被拒且不触达 Pro 服务', async () => {
+    setProCompliance({
+      createExportJob: mocks.createExportJob,
+      createDeleteJob: mocks.createDeleteJob,
+    })
+    setProBilling({
+      getEffectivePlan: mocks.getEffectivePlan,
+    })
+    mocks.getEffectivePlan.mockResolvedValue({
+      planName: 'enterprise',
+      features: { compliance: true },
+    })
+    rateLimit.checkRateLimit.mockReturnValue({ allowed: false, retryAfterMs: 3_600_000 })
+
+    await expect(requestMyDeletionFn({ data: {} })).rejects.toThrow('删除请求过于频繁')
+    expect(mocks.createDeleteJob).not.toHaveBeenCalled()
+
+    // key 按 userId 分桶（compliance-delete:<uid>），与 export（compliance-export:<uid>）隔离
+    expect(rateLimit.checkRateLimit).toHaveBeenCalledWith('compliance-delete:u1', {
+      max: 1,
+      windowMs: 3_600_000,
+    })
+  })
 })

package/src/server/serverFns/__tests__/knowledge-index.test.ts

@@ -56,6 +56,7 @@ vi.mock('@allbluecn/database', () => ({
 vi.mock('@/server/ai-gateway/embedding', () => ({
   generateEmbedding: vi.fn(),
   chunkText: vi.fn((t: string) => [t]),
+  OPENROUTER_BASE_URL: 'https://openrouter.ai/api/v1',
 }))
 
 vi.mock('@/server/ai-gateway/provider-router', () => ({

package/src/server/serverFns/__tests__/knowledge-kb-projects.test.ts

@@ -0,0 +1,141 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// KB ↔ 项目关联的鉴权（审计 2026-10-25 🟠 listKbProjectsFn 任意 kbId 可枚举关联项目；
+// 🟡 setKbProjectsFn 可把自己的 KB 关联到任意项目，使 KB 内容暴露给该项目全员）。
+// 同文件 getDocumentPreviewFn（🔴 IDOR）已整体移除——零消费方的死 RPC，此处断言其不再导出。
+
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: (_config: unknown) => {
+    const api = {
+      _validator: undefined as unknown,
+      validator(schema: unknown) {
+        this._validator = schema
+        return this
+      },
+      handler(fn: (args: { data: unknown }) => Promise<unknown>) {
+        return async (args: unknown) => fn({ data: (args as { data?: unknown } | null | undefined)?.data })
+      },
+    }
+    return api
+  },
+}))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: vi.fn(),
+}))
+
+const m = vi.hoisted(() => {
+  const prismaMock = {
+    knowledgeBase: { findFirst: vi.fn() },
+    projectKnowledgeBase: { findMany: vi.fn(), deleteMany: vi.fn(), createMany: vi.fn() },
+    projectMember: { count: vi.fn() },
+    $transaction: vi.fn(),
+  }
+  ;(globalThis as { prisma?: unknown }).prisma = prismaMock
+  return prismaMock
+})
+
+vi.mock('@allbluecn/database/get-prisma', () => ({ getPrisma: async () => m }))
+vi.mock('@allbluecn/database', () => ({ prisma: m }))
+
+vi.mock('@/server/auth-helpers', () => ({ requireAuth: vi.fn() }))
+vi.mock('@/server/permissions', () => ({ requirePermission: vi.fn() }))
+vi.mock('@/server/audit', () => ({ auditLog: vi.fn() }))
+vi.mock('@/server/knowledge/knowledge-index-utils', () => ({
+  resolveAiConfig: vi.fn(),
+  KB_EMBEDDINGS_TABLE: 'knowledge_embeddings' as const,
+  indexDocumentById: vi.fn(),
+  extractText: vi.fn(),
+}))
+
+import { requireAuth } from '@/server/auth-helpers'
+import * as knowledge from '../knowledge'
+
+const USER = 'u-1'
+type Fn = (args: { data: unknown }) => Promise<unknown>
+const listKbProjects = knowledge.listKbProjectsFn as unknown as Fn
+const setKbProjects = knowledge.setKbProjectsFn as unknown as Fn
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  vi.mocked(requireAuth).mockResolvedValue({ user: { id: USER } } as never)
+  m.$transaction.mockImplementation(async (fn: (tx: typeof m) => unknown) => fn(m))
+})
+
+describe('getDocumentPreviewFn 已移除', () => {
+  it('模块不再导出该裸 id 直查的死 RPC', () => {
+    expect((knowledge as Record<string, unknown>).getDocumentPreviewFn).toBeUndefined()
+  })
+})
+
+describe('listKbProjectsFn', () => {
+  it('kbId 不在当前用户可读范围 → 知识库不存在，不读关联', async () => {
+    m.knowledgeBase.findFirst.mockResolvedValue(null)
+    await expect(listKbProjects({ data: { kbId: 'kb-x' } })).rejects.toThrow('知识库不存在')
+    expect(m.projectKnowledgeBase.findMany).not.toHaveBeenCalled()
+    const where = m.knowledgeBase.findFirst.mock.calls[0][0].where
+    expect(where).toEqual(
+      expect.objectContaining({
+        id: 'kb-x',
+        isDeleted: false,
+        OR: [{ userId: USER }, { visibility: { in: ['team', 'general'] } }],
+      }),
+    )
+  })
+
+  it('可读 KB → 返回关联项目列表', async () => {
+    m.knowledgeBase.findFirst.mockResolvedValue({ id: 'kb-1' })
+    m.projectKnowledgeBase.findMany.mockResolvedValue([
+      { project: { id: 'p1', name: 'P1', icon: 'folder' } },
+    ])
+    expect(await listKbProjects({ data: { kbId: 'kb-1' } })).toEqual([{ id: 'p1', name: 'P1', icon: 'folder' }])
+  })
+})
+
+describe('setKbProjectsFn', () => {
+  beforeEach(() => {
+    m.knowledgeBase.findFirst.mockResolvedValue({ visibility: 'team' })
+  })
+
+  it('projectIds 含非成员项目 → 无权限关联该项目，不写入', async () => {
+    m.projectMember.count.mockResolvedValue(1)
+    await expect(setKbProjects({ data: { kbId: 'kb-1', projectIds: ['p1', 'p2'] } })).rejects.toThrow(
+      '无权限关联该项目',
+    )
+    expect(m.$transaction).not.toHaveBeenCalled()
+    expect(m.projectMember.count).toHaveBeenCalledWith({
+      where: { userId: USER, projectId: { in: ['p1', 'p2'] }, status: { not: 'suspended' } },
+    })
+  })
+
+  it('全部为有效成员项目 → 覆盖写关联', async () => {
+    m.projectMember.count.mockResolvedValue(2)
+    expect(await setKbProjects({ data: { kbId: 'kb-1', projectIds: ['p1', 'p2', 'p1'] } })).toEqual({ ok: true })
+    expect(m.projectKnowledgeBase.deleteMany).toHaveBeenCalledWith({
+      where: { kbId: 'kb-1', projectId: { notIn: ['p1', 'p2', 'p1'] } },
+    })
+    expect(m.projectKnowledgeBase.createMany).toHaveBeenCalled()
+  })
+
+  it('清空关联（空数组）不触发成员校验', async () => {
+    expect(await setKbProjects({ data: { kbId: 'kb-1', projectIds: [] } })).toEqual({ ok: true })
+    expect(m.projectMember.count).not.toHaveBeenCalled()
+  })
+})

package/src/server/serverFns/__tests__/knowledge-public-compliance.test.ts

@@ -0,0 +1,163 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 审计 2026-10-25（A2x-serverfns-4）公共合规域回归：
+// - update：canonicalId 仅在显式传 code 时重算（主会话裁定），仅改 title 不漂移；
+// - unshare：无其他分享者时本人 public 行回落 private（对齐 bookmark 版）；
+// - public：分享页只回 public 版本行，不借「公有副本存在」放行私有行。
+
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: (_config: unknown) => {
+    const api = {
+      _validator: undefined as unknown,
+      validator(schema: unknown) {
+        this._validator = schema
+        return this
+      },
+      handler(fn: (args: { data: unknown }) => Promise<unknown>) {
+        const wrapped = async (args: unknown) => {
+          let data = (args as { data?: unknown } | null | undefined)?.data
+          if (this._validator && data !== undefined) {
+            const v = this._validator as { parse?: (d: unknown) => unknown }
+            data = v.parse ? v.parse(data) : data
+          }
+          return fn({ data })
+        }
+        return wrapped
+      },
+    }
+    return api
+  },
+}))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: vi.fn(),
+}))
+
+const m = vi.hoisted(() => ({
+  industryCompliance: {
+    findUnique: vi.fn(),
+    findFirst: vi.fn(),
+    update: vi.fn(),
+    updateMany: vi.fn(),
+  },
+  knowledgeShareRecord: {
+    deleteMany: vi.fn(),
+    findFirst: vi.fn(),
+  },
+}))
+
+vi.mock('@allbluecn/database/get-prisma', () => ({ getPrisma: async () => m }))
+vi.mock('@allbluecn/database', () => ({ Prisma: {} }))
+
+vi.mock('@/server/auth-helpers', () => ({ requireAuth: vi.fn() }))
+
+import { requireAuth } from '@/server/auth-helpers'
+import * as updateMod from '../knowledge/public/compliance/update'
+import * as unshareMod from '../knowledge/public/compliance/unshare'
+import { getPublicComplianceFn } from '../knowledge/public/compliance/public'
+
+const mockRequireAuth = vi.mocked(requireAuth)
+
+describe('updateComplianceFn：canonicalId 重算口径（审计 🟠，主会话裁定）', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockRequireAuth.mockResolvedValue({ user: { id: 'u1', role: 'USER' } } as never)
+    m.industryCompliance.update.mockResolvedValue({ id: 'row-1' })
+  })
+
+  it('仅改 title（code 未传）→ canonicalId 保持不变（历史收藏/分享关联不失联）', async () => {
+    m.industryCompliance.findUnique.mockResolvedValue({ id: 'row-1', userId: 'u1', title: '旧标题' })
+    await updateMod.updateComplianceFn({ data: { id: 'row-1', title: '新标题' } })
+    expect(m.industryCompliance.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.not.objectContaining({ canonicalId: expect.anything() }),
+      }),
+    )
+  })
+
+  it('显式传 code → canonicalId 以 code 重算', async () => {
+    m.industryCompliance.findUnique.mockResolvedValue({ id: 'row-1', userId: 'u1', title: '旧标题' })
+    await updateMod.updateComplianceFn({ data: { id: 'row-1', code: 'GB 4943' } })
+    expect(m.industryCompliance.update).toHaveBeenCalledWith(
+      expect.objectContaining({ data: expect.objectContaining({ canonicalId: 'GB 4943' }) }),
+    )
+  })
+
+  it('code + title 同时传 → code 维度优先', async () => {
+    m.industryCompliance.findUnique.mockResolvedValue({ id: 'row-1', userId: 'u1', title: '旧标题' })
+    await updateMod.updateComplianceFn({ data: { id: 'row-1', title: '新标题', code: 'GB 4943-2024' } })
+    expect(m.industryCompliance.update).toHaveBeenCalledWith(
+      expect.objectContaining({ data: expect.objectContaining({ canonicalId: 'GB 4943-2024' }) }),
+    )
+  })
+})
+
+describe('unshareComplianceFn：无其他分享者时回落 private（审计 🟠）', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockRequireAuth.mockResolvedValue({ user: { id: 'u1', role: 'USER' } } as never)
+  })
+
+  it('存在其他分享者 → 仅删本人 share 记录，不动 visibility', async () => {
+    m.knowledgeShareRecord.deleteMany.mockResolvedValue({ count: 1 })
+    m.knowledgeShareRecord.findFirst.mockResolvedValue({ id: 'other-sharer' })
+    const r = await unshareMod.unshareComplianceFn({ data: { canonicalId: 'c-1' } })
+    expect(r).toEqual({ success: true })
+    expect(m.industryCompliance.updateMany).not.toHaveBeenCalled()
+  })
+
+  it('无其他分享者 → 本人 public 行回落 private', async () => {
+    m.knowledgeShareRecord.deleteMany.mockResolvedValue({ count: 1 })
+    m.knowledgeShareRecord.findFirst.mockResolvedValue(null)
+    m.industryCompliance.updateMany.mockResolvedValue({ count: 1 })
+    await unshareMod.unshareComplianceFn({ data: { canonicalId: 'c-1' } })
+    expect(m.industryCompliance.updateMany).toHaveBeenCalledWith({
+      where: { canonicalId: 'c-1', userId: 'u1', visibility: 'public', isDeleted: false },
+      data: { visibility: 'private' },
+    })
+  })
+})
+
+describe('getPublicComplianceFn：只回 public 版本行（审计 🟠 逻辑错位）', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('请求 id 是他人 private 副本时，返回同 canonicalId 的 public 行而非该私有行', async () => {
+    m.industryCompliance.findFirst
+      .mockResolvedValueOnce({ id: 'row-private', canonicalId: 'c-1' })
+      .mockResolvedValueOnce({ id: 'row-public', canonicalId: 'c-1', title: '公开版', visibility: 'public', user: { id: 'u2', username: 'bob' } })
+    const r = await getPublicComplianceFn({ data: { id: 'row-private' } })
+    expect((r as { id: string }).id).toBe('row-public')
+    // 第二次查询必须限定 visibility public
+    expect(m.industryCompliance.findFirst.mock.calls[1][0].where).toMatchObject({
+      canonicalId: 'c-1',
+      visibility: 'public',
+      isDeleted: false,
+    })
+  })
+
+  it('无 public 版本（未分享）→ 抛「未分享」', async () => {
+    m.industryCompliance.findFirst
+      .mockResolvedValueOnce({ id: 'row-a', canonicalId: 'c-9' })
+      .mockResolvedValueOnce(null)
+    await expect(getPublicComplianceFn({ data: { id: 'row-a' } })).rejects.toThrow('未分享')
+  })
+})