@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/__tests__/knowledge-readable-kb.test.ts

@@ -0,0 +1,194 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 审计 2026-10-25（A2x-serverfns-4 🟠）读口径统一回归：createDocumentFn 用
+// READABLE_KB（自己的 KB ∪ 他人 team/general KB）建文档，list / get / homepage /
+// breadcrumb 四个读路径曾只认 kb.userId —— 在他人共享 KB 建的文档无法列出/读取。
+// 本文件钉死四个读入口的 where 必须携带 READABLE_KB 的 OR 分支，
+// 以及 createDocumentFn 的 parentId 同库校验。
+
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: (_config: unknown) => {
+    const api = {
+      _validator: undefined as unknown,
+      validator(schema: unknown) {
+        this._validator = schema
+        return this
+      },
+      handler(fn: (args: { data: unknown }) => Promise<unknown>) {
+        const wrapped = async (args: unknown) => {
+          let data = (args as { data?: unknown } | null | undefined)?.data
+          if (this._validator && data !== undefined) {
+            const v = this._validator as { parse?: (d: unknown) => unknown }
+            data = v.parse ? v.parse(data) : data
+          }
+          return fn({ data })
+        }
+        return wrapped
+      },
+    }
+    return api
+  },
+}))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: vi.fn(),
+}))
+
+const m = vi.hoisted(() => {
+  const prismaMock = {
+    knowledgeBase: { findFirst: vi.fn() },
+    knowledgeDocument: { findFirst: vi.fn(), findMany: vi.fn(), create: vi.fn(), aggregate: vi.fn() },
+    $transaction: vi.fn(),
+  }
+  ;(globalThis as { prisma?: unknown }).prisma = prismaMock
+  return prismaMock
+})
+
+vi.mock('@allbluecn/database/get-prisma', () => ({ getPrisma: async () => m }))
+vi.mock('@allbluecn/database', () => ({ prisma: m }))
+
+vi.mock('@/server/auth-helpers', () => ({ requireAuth: vi.fn() }))
+vi.mock('@/server/permissions', () => ({ requirePermission: vi.fn() }))
+vi.mock('@/server/audit', () => ({ auditLog: vi.fn() }))
+vi.mock('@/server/knowledge/knowledge-index-utils', () => ({
+  resolveAiConfig: vi.fn(),
+  KB_EMBEDDINGS_TABLE: 'knowledge_embeddings' as const,
+  indexDocumentById: vi.fn(),
+  indexDocumentEmbeddings: vi.fn(),
+  extractText: vi.fn(),
+}))
+vi.mock('@/server/ai-gateway/embedding', () => ({
+  generateEmbedding: vi.fn(),
+  chunkText: vi.fn((t: string) => [t]),
+}))
+vi.mock('@/server/ai-gateway/rerank', () => ({
+  rerankCandidates: vi.fn(),
+  RECALL_MULTIPLIER: 4,
+}))
+vi.mock('@/lib/vector-store', () => ({
+  getVectorStore: vi.fn(async () => ({
+    searchByVector: vi.fn(),
+    insertEmbedding: vi.fn(),
+    deleteEmbeddings: vi.fn(),
+  })),
+}))
+vi.mock('@/server/lib/ownership', () => ({ assertOwned: vi.fn() }))
+vi.mock('@/server/lib/project-membership', () => ({ assertProjectsMembership: vi.fn() }))
+vi.mock('@/server/collab/write-guard', () => ({ withCollabGuard: vi.fn() }))
+vi.mock('@/server/collab/touch-snapshot', () => ({ touchCollabSnapshot: vi.fn() }))
+vi.mock('@allbluecn/collab-core/rooms', () => ({ buildRoomName: vi.fn(() => 'room') }))
+
+import {
+  listDocumentsFn,
+  getDocumentFn,
+  getHomepageDocumentFn,
+  getDocBreadcrumbFn,
+  createDocumentFn,
+} from '../knowledge'
+import { requireAuth } from '@/server/auth-helpers'
+
+const SESSION = { user: { id: 'user-1' } }
+
+/** READABLE_KB 的嵌套/顶层 where 必须带 OR 双分支（本人 ∪ team/general） */
+function expectReadableWhere(where: Record<string, unknown> | undefined) {
+  expect(where).toBeDefined()
+  expect(where!.isDeleted).toBe(false)
+  expect(Array.isArray(where!.OR)).toBe(true)
+  expect(where!.OR).toEqual([
+    { userId: 'user-1' },
+    { visibility: { in: ['team', 'general'] } },
+  ])
+}
+
+describe('KB 读口径统一 READABLE_KB（审计 🟠：读写口径不一致）', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(requireAuth).mockResolvedValue(SESSION as never)
+  })
+
+  it('listDocumentsFn：kb 查询走 READABLE_KB；可读时返回文档树', async () => {
+    m.knowledgeBase.findFirst.mockResolvedValue({ id: 'kb-1' })
+    m.knowledgeDocument.findMany.mockResolvedValue([])
+    await listDocumentsFn({ data: { kbId: 'kb-1' } })
+    expectReadableWhere(m.knowledgeBase.findFirst.mock.calls[0][0].where)
+  })
+
+  it('getDocumentFn：文档查询的 kb 关系过滤走 READABLE_KB', async () => {
+    m.knowledgeDocument.findFirst.mockResolvedValue(null)
+    await expect(getDocumentFn({ data: { id: 'doc-1' } })).rejects.toThrow('未找到或无权限')
+    expectReadableWhere(m.knowledgeDocument.findFirst.mock.calls[0][0].where.kb)
+  })
+
+  it('getHomepageDocumentFn：kb 查询走 READABLE_KB', async () => {
+    m.knowledgeBase.findFirst.mockResolvedValue({ id: 'kb-1' })
+    m.knowledgeDocument.findFirst.mockResolvedValue(null)
+    await getHomepageDocumentFn({ data: { kbId: 'kb-1' } })
+    expectReadableWhere(m.knowledgeBase.findFirst.mock.calls[0][0].where)
+  })
+
+  it('getDocBreadcrumbFn：kb 查询走 READABLE_KB', async () => {
+    m.knowledgeBase.findFirst.mockResolvedValue({ id: 'kb-1' })
+    m.knowledgeDocument.findMany.mockResolvedValue([])
+    await getDocBreadcrumbFn({ data: { docId: 'doc-1', kbId: 'kb-1' } })
+    expectReadableWhere(m.knowledgeBase.findFirst.mock.calls[0][0].where)
+  })
+
+  it('KB 不可读（私有他人 KB）时四个读入口一律拒绝', async () => {
+    m.knowledgeBase.findFirst.mockResolvedValue(null)
+    m.knowledgeDocument.findFirst.mockResolvedValue(null)
+    await expect(listDocumentsFn({ data: { kbId: 'kb-x' } })).rejects.toThrow('未找到或无权限')
+    await expect(getHomepageDocumentFn({ data: { kbId: 'kb-x' } })).rejects.toThrow('未找到或无权限')
+    await expect(getDocBreadcrumbFn({ data: { docId: 'doc-1', kbId: 'kb-x' } })).rejects.toThrow('未找到或无权限')
+  })
+})
+
+describe('createDocumentFn：parentId 同库校验 + maxSort 同事务（审计 🟡）', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(requireAuth).mockResolvedValue(SESSION as never)
+    m.$transaction.mockImplementation(async (op: unknown) =>
+      typeof op === 'function'
+        ? (op as (tx: typeof m) => unknown)(m)
+        : Promise.all(op as Promise<unknown>[]),
+    )
+  })
+
+  it('parentId 不属于同一 KB（不存在/他库节点）时拒绝创建', async () => {
+    m.knowledgeBase.findFirst.mockResolvedValue({ id: 'kb-1' })
+    m.knowledgeDocument.findFirst.mockResolvedValue(null)
+    await expect(
+      createDocumentFn({ data: { kbId: 'kb-1', parentId: 'doc-foreign', title: '新文档' } }),
+    ).rejects.toThrow('父文档不存在')
+    expect(m.$transaction).not.toHaveBeenCalled()
+  })
+
+  it('parentId 同库合法时经事务创建（maxSort 聚合 + create 同事务）', async () => {
+    m.knowledgeBase.findFirst.mockResolvedValue({ id: 'kb-1' })
+    m.knowledgeDocument.findFirst.mockResolvedValue({ id: 'doc-parent' })
+    m.knowledgeDocument.aggregate.mockResolvedValue({ _max: { sortOrder: 3 } })
+    m.knowledgeDocument.create.mockResolvedValue({ id: 'doc-new', title: '新文档', type: 'doc', parentId: 'doc-parent' })
+    const doc = await createDocumentFn({ data: { kbId: 'kb-1', parentId: 'doc-parent', title: '新文档' } })
+    expect(doc).toMatchObject({ id: 'doc-new' })
+    expect(m.$transaction).toHaveBeenCalledTimes(1)
+    expect(m.knowledgeDocument.create).toHaveBeenCalledWith(
+      expect.objectContaining({ data: expect.objectContaining({ sortOrder: 4, parentId: 'doc-parent', kbId: 'kb-1' }) }),
+    )
+  })
+})

package/src/server/serverFns/__tests__/legal-public.test.ts

@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 审计 A2x-serverfns-5 🟠（2026-10-25）：getPublicLegalFn 旧实现按 URL id 返回
+// 任意记录全文（含他人 private 草稿）——只要同 canonicalId 存在公共副本。
+// 回归哨兵：分享页只返回公共副本内容；id 保留 URL id（收藏语义锚点）。
+
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const M = vi.hoisted(() => ({
+  findFirst: vi.fn(),
+}))
+
+vi.mock('@allbluecn/database/get-prisma', () => ({
+  getPrisma: async () => ({ legalRegulation: { findFirst: M.findFirst } }),
+}))
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const api: any = {
+      validator() {
+        return this
+      },
+      handler(fn: Function) {
+        return async (args: any) => fn(args)
+      },
+    }
+    return api
+  },
+}))
+
+import { getPublicLegalFn } from '../knowledge/public/legal/public'
+
+const URL_ID = 'src-private-id'
+const CANONICAL = '国家安全法'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('getPublicLegalFn（只返回公共副本内容）', () => {
+  it('内容来自 visibility=public 副本，id 保留 URL id', async () => {
+    M.findFirst
+      .mockResolvedValueOnce({ id: URL_ID, canonicalId: CANONICAL })
+      .mockResolvedValueOnce({
+        id: 'public-copy-id',
+        canonicalId: CANONICAL,
+        title: '公共版标题',
+        content: '公共版全文',
+        user: { id: 'sharer', username: 'sharer' },
+      })
+
+    const res = await getPublicLegalFn({ data: { id: URL_ID } })
+
+    // 第二次查询按 canonicalId + public 收敛
+    expect(M.findFirst).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        where: { canonicalId: CANONICAL, visibility: 'public', isDeleted: false },
+      }),
+    )
+    expect(res.id).toBe(URL_ID)
+    expect(res.content).toBe('公共版全文')
+  })
+
+  it('同 canonicalId 无公共副本：拒绝（不回落私有副本全文）', async () => {
+    M.findFirst
+      .mockResolvedValueOnce({ id: URL_ID, canonicalId: CANONICAL })
+      .mockResolvedValueOnce(null)
+
+    await expect(getPublicLegalFn({ data: { id: URL_ID } })).rejects.toThrow('未分享')
+  })
+
+  it('URL id 不存在：未找到', async () => {
+    M.findFirst.mockResolvedValueOnce(null)
+    await expect(getPublicLegalFn({ data: { id: 'ghost' } })).rejects.toThrow('未找到')
+    expect(M.findFirst).toHaveBeenCalledTimes(1)
+  })
+})

package/src/server/serverFns/__tests__/notifications-list.test.ts

@@ -0,0 +1,130 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 审计 A2x-serverfns-5 🟡（2026-10-25）：
+// ① listNotificationsFn 的 total 契约语义 = 过滤条件下的真实总数（count 并行查询），
+//    旧实现返回 page.length（≤20）；
+// ② DND 时间校验收紧为严格 24 小时制 HH:MM（99:99 / 25:70 不再放行）。
+
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const M = vi.hoisted(() => {
+  const f = () => vi.fn()
+  return {
+    requireAuth: f(),
+    findMany: f(),
+    count: f(),
+    upsert: f(),
+    getOrCreatePreferences: f(),
+  }
+})
+
+vi.mock('@allbluecn/database/get-prisma', () => ({
+  getPrisma: async () => ({
+    notification: { findMany: M.findMany, count: M.count },
+    notificationPreference: { upsert: M.upsert },
+  }),
+}))
+
+vi.mock('@/server/auth-helpers', () => ({ requireAuth: M.requireAuth }))
+vi.mock('@/server/notifications/notification-service', () => ({
+  getOrCreatePreferences: M.getOrCreatePreferences,
+  DEFAULT_CATEGORIES: {},
+  normalizeEmailCategories: (v: unknown) => v ?? {},
+}))
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema
+        return this
+      },
+      handler(fn: Function) {
+        const wrapped = async (args: any) => {
+          let data = args?.data
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse(data)
+          }
+          return fn({ data })
+        }
+        return wrapped
+      },
+    }
+    return api
+  },
+}))
+vi.mock('@tanstack/react-start/server', () => ({ getRequest: () => ({ url: 'http://test/' }) }))
+
+import { listNotificationsFn, updateNotificationPreferencesFn } from '../notifications'
+
+const USER = 'u-1'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  M.requireAuth.mockResolvedValue({ user: { id: USER } })
+})
+
+describe('listNotificationsFn total 语义', () => {
+  it('total 来自 count 查询（过滤条件下的真实总数），非当前页条数', async () => {
+    M.findMany.mockResolvedValue([
+      { id: 'n1', category: 'system', type: 't', title: 'a', body: null, link: null, readAt: null, createdAt: new Date('2026-09-10T00:00:00Z') },
+      { id: 'n2', category: 'system', type: 't', title: 'b', body: null, link: null, readAt: null, createdAt: new Date('2026-09-09T00:00:00Z') },
+    ])
+    M.count.mockResolvedValue(57)
+
+    const res = await listNotificationsFn({ data: { status: 'unread' } })
+
+    expect(M.count).toHaveBeenCalledWith({ where: { userId: USER, readAt: null } })
+    expect(res.items).toHaveLength(2)
+    expect(res.total).toBe(57)
+    expect(res.hasMore).toBe(false)
+    // count 与取页使用同一过滤条件
+    expect(M.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { userId: USER, readAt: null } }),
+    )
+  })
+})
+
+describe('updateNotificationPreferencesFn DND 时间校验', () => {
+  const base = {
+    categories: { team: 'realtime', collaboration: 'off', system: 'realtime', billing: 'off', security: 'off' } as const,
+    dndEnabled: true,
+  }
+
+  it('非法时间（99:99 / 25:70 / 7:30）被拒', async () => {
+    for (const bad of ['99:99', '25:70', '7:30', '12:60']) {
+      await expect(
+        updateNotificationPreferencesFn({ data: { ...base, dndStart: bad, dndEnd: '08:00' } }),
+      ).rejects.toThrow()
+    }
+    expect(M.upsert).not.toHaveBeenCalled()
+  })
+
+  it('合法 24 小时制 HH:MM 通过并落库', async () => {
+    M.upsert.mockResolvedValue({})
+    const res = await updateNotificationPreferencesFn({
+      data: { ...base, dndStart: '23:59', dndEnd: '00:05' },
+    })
+    expect(res).toEqual({ success: true })
+    expect(M.upsert).toHaveBeenCalledWith(
+      expect.objectContaining({
+        update: expect.objectContaining({ dndStart: '23:59', dndEnd: '00:05' }),
+      }),
+    )
+  })
+})

package/src/server/serverFns/__tests__/ownership-merge.test.ts

@@ -68,7 +68,15 @@ vi.mock("@allbluecn/database", () => ({
     $transaction: M.$transaction,
   },
 }));
-vi.mock("@/server/auth-helpers", () => ({ requireAuth: M.requireAuth }));
+vi.mock("@/server/auth-helpers", () => ({
+  requireAuth: M.requireAuth,
+  // A2x-1 批次新增的共享收窄（agent-crud/skill-crud 消费）
+  requireUserId: async (...args: unknown[]) => {
+    const session = await M.requireAuth(...args)
+    if (!session?.user?.id) throw new Error("UNAUTHORIZED")
+    return session.user.id
+  },
+}));
 vi.mock("@/server/permissions", () => ({ requirePermission: M.requirePermission }));
 vi.mock("@/server/audit", () => ({ auditLog: M.auditLog }));
 vi.mock("@/server/knowledge/knowledge-index-utils", () => ({
@@ -305,12 +313,12 @@ describe("agents/skill 属主校验合并（updateMany 计数）", () => {
     M.userAgent.updateMany.mockResolvedValue({ count: 1 });
     expect(await updateAgentFn({ data: { id: "a-1", name: "n" } })).toEqual({ success: true });
     expect(M.userAgent.updateMany).toHaveBeenCalledWith({
-      where: { id: "a-1", userId: USER },
+      where: { id: "a-1", userId: USER, isDeleted: false },
       data: { name: "n" },
     });
     expect(await deleteAgentFn({ data: { id: "a-1" } })).toEqual({ success: true });
     expect(M.userAgent.updateMany).toHaveBeenLastCalledWith({
-      where: { id: "a-1", userId: USER },
+      where: { id: "a-1", userId: USER, isDeleted: false },
       data: { isDeleted: true },
     });
     expect(M.userAgent.findFirst).not.toHaveBeenCalled();
@@ -324,7 +332,7 @@ describe("agents/skill 属主校验合并（updateMany 计数）", () => {
     M.userSkill.updateMany.mockResolvedValue({ count: 1 });
     expect(await updateSkillFn({ data: { id: "s-1", title: "t" } })).toEqual({ success: true });
     expect(M.userSkill.updateMany).toHaveBeenCalledWith({
-      where: { id: "s-1", userId: USER },
+      where: { id: "s-1", userId: USER, isDeleted: false },
       data: { title: "t" },
     });
     expect(await deleteSkillFn({ data: { id: "s-1" } })).toEqual({ success: true });

package/src/server/serverFns/__tests__/project-delete-transaction.test.ts

@@ -0,0 +1,128 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 审计 A2x-serverfns-5 🟡（2026-10-25）：deleteProjectFn 的「需求迁移/清空 +
+// 删项目」必须原子——迁移成功而 delete 失败不得留下半迁移态。
+// 回归哨兵：两条路径（transfer / clear）都必须在 $transaction 内执行，
+// 且迁移函数收到 tx 客户端（第三参）。
+
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const M = vi.hoisted(() => {
+  const f = () => vi.fn()
+  const tx = {
+    story: { deleteMany: f(), findMany: f() },
+    project: { delete: f() },
+  }
+  return {
+    tx,
+    projectMemberFindUnique: f(),
+    storyCount: f(),
+    transaction: f(),
+    migrate: f(),
+    requireAuth: f(),
+  }
+})
+
+vi.mock('@allbluecn/database/get-prisma', () => ({
+  getPrisma: async () => ({
+    projectMember: { findUnique: M.projectMemberFindUnique },
+    story: { count: M.storyCount },
+    $transaction: M.transaction,
+  }),
+}))
+
+vi.mock('@/server/auth-helpers', () => ({ requireAuth: M.requireAuth }))
+vi.mock('@/server/builtin-project', () => ({
+  ensureBuiltinIndependentProject: vi.fn(),
+  migrateStoriesToIndependentProject: M.migrate,
+}))
+vi.mock('@/server/audit', () => ({ auditLog: vi.fn() }))
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const api: any = {
+      validator(_schema: unknown) {
+        return this
+      },
+      handler(fn: (args: { data: unknown }) => unknown) {
+        return async (args: { data: unknown }) => fn(args)
+      },
+    }
+    return api
+  },
+}))
+vi.mock('@tanstack/react-start/server', () => ({ getRequest: () => ({ url: 'http://test/' }) }))
+
+import { deleteProjectFn } from '../project'
+
+const OWNER = 'owner-1'
+const PROJECT_ID = 'p-1'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  M.requireAuth.mockResolvedValue({ user: { id: OWNER } })
+  M.projectMemberFindUnique.mockResolvedValue({ id: 'pm-1', role: 'owner', status: 'active' })
+  M.storyCount.mockResolvedValue(2)
+  // 交互式事务：以 tx 客户端执行回调
+  M.transaction.mockImplementation(async (fn: (tx: typeof M.tx) => Promise<unknown>) => fn(M.tx))
+  M.tx.story.findMany.mockResolvedValue([{ id: 's1' }, { id: 's2' }])
+  M.tx.story.deleteMany.mockResolvedValue({ count: 2 })
+  M.tx.project.delete.mockResolvedValue({ id: PROJECT_ID })
+  M.migrate.mockResolvedValue(undefined)
+})
+
+describe('deleteProjectFn（迁移/清空与删项目原子化）', () => {
+  it('transfer：迁移与删项目在同一 $transaction 内，迁移收到 tx', async () => {
+    const res = await deleteProjectFn({ data: { projectId: PROJECT_ID, mode: 'transfer' } })
+
+    expect(M.transaction).toHaveBeenCalledTimes(1)
+    expect(M.tx.story.findMany).toHaveBeenCalledWith({
+      where: { projectId: PROJECT_ID },
+      select: { id: true },
+    })
+    expect(M.migrate).toHaveBeenCalledWith(OWNER, ['s1', 's2'], M.tx)
+    expect(M.tx.project.delete).toHaveBeenCalledWith({ where: { id: PROJECT_ID } })
+    expect(res).toEqual({ success: true })
+  })
+
+  it('clear：清空需求与删项目在同一 $transaction 内', async () => {
+    await deleteProjectFn({ data: { projectId: PROJECT_ID, mode: 'clear' } })
+
+    expect(M.transaction).toHaveBeenCalledTimes(1)
+    expect(M.tx.story.deleteMany).toHaveBeenCalledWith({ where: { projectId: PROJECT_ID } })
+    expect(M.migrate).not.toHaveBeenCalled()
+    expect(M.tx.project.delete).toHaveBeenCalledWith({ where: { id: PROJECT_ID } })
+  })
+
+  it('事务失败：不吞错（迁移+删除整体回滚语义由 Prisma 事务保证）', async () => {
+    M.tx.project.delete.mockRejectedValue(new Error('FK restrict'))
+    await expect(
+      deleteProjectFn({ data: { projectId: PROJECT_ID, mode: 'clear' } }),
+    ).rejects.toThrow('FK restrict')
+    expect(M.transaction).toHaveBeenCalledTimes(1)
+  })
+
+  it('无需求且未传 mode：仍在事务内直接删除项目', async () => {
+    M.storyCount.mockResolvedValue(0)
+    const res = await deleteProjectFn({ data: { projectId: PROJECT_ID } })
+    expect(M.transaction).toHaveBeenCalledTimes(1)
+    expect(M.tx.story.deleteMany).not.toHaveBeenCalled()
+    expect(M.migrate).not.toHaveBeenCalled()
+    expect(M.tx.project.delete).toHaveBeenCalledWith({ where: { id: PROJECT_ID } })
+    expect(res).toEqual({ success: true })
+  })
+})

package/src/server/serverFns/__tests__/project-kb.test.ts

@@ -43,6 +43,7 @@ vi.mock("@tanstack/react-start", () => ({
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
 
 const mocks = vi.hoisted(() => ({
+  memberFindUnique: vi.fn(),
   pkbFindMany: vi.fn(),
   pkbDeleteMany: vi.fn(),
   pkbCreateMany: vi.fn(),
@@ -55,6 +56,7 @@ const mocks = vi.hoisted(() => ({
 
 vi.mock("@allbluecn/database", () => {
   const prisma = {
+    projectMember: { findUnique: mocks.memberFindUnique },
     projectKnowledgeBase: {
       findMany: mocks.pkbFindMany,
       deleteMany: mocks.pkbDeleteMany,
@@ -77,6 +79,8 @@ import { setKbProjectsFn, listKbProjectsFn } from "../knowledge";
 beforeEach(() => {
   vi.clearAllMocks();
   mocks.currentSession.mockResolvedValue({ user: { id: "u1" } });
+  // 默认：u1 是目标项目的 owner（审计 2026-10-25：KB 关联读写补项目成员/owner+admin 校验）
+  mocks.memberFindUnique.mockResolvedValue({ role: "owner", status: "active" });
 });
 
 describe("setProjectKbsFn 校验", () => {
@@ -128,6 +132,20 @@ describe("setKbProjectsFn 校验", () => {
   });
 });
 
+describe("setProjectKbsFn / listProjectKbsFn 成员边界", () => {
+  it("非成员读项目关联 KB → 拒绝", async () => {
+    mocks.memberFindUnique.mockResolvedValue(null);
+    await expect(listProjectKbsFn({ data: { projectId: "p1" } })).rejects.toThrow("未找到项目或无访问权限");
+    expect(mocks.pkbFindMany).not.toHaveBeenCalled();
+  });
+
+  it("成员（非 owner/admin）写关联 → 权限不足", async () => {
+    mocks.memberFindUnique.mockResolvedValue({ role: "member", status: "active" });
+    await expect(setProjectKbsFn({ data: { projectId: "p1", kbIds: [] } })).rejects.toThrow("权限不足");
+    expect(mocks.transaction).not.toHaveBeenCalled();
+  });
+});
+
 describe("listProjectKbsFn / listKbProjectsFn", () => {
   it("项目侧返回 KB 概要", async () => {
     mocks.pkbFindMany.mockResolvedValue([