@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/__tests__/read-path-permissions.test.ts

@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 审计 2026-10-25 主题 1：iteration / testcase 域读路径守卫（资源 → 项目 → 成员）单元测试。
+// handler 接线由各域既有 happy-path 测试（现须 memberOk）覆盖，本文件钉死守卫本身的语义。
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const M = vi.hoisted(() => {
+  const f = () => vi.fn();
+  return {
+    iteration: { findUnique: f() },
+    testCase: { findUnique: f() },
+    testPlan: { findUnique: f() },
+    testRun: { findUnique: f() },
+    testRunCase: { findUnique: f() },
+    projectMember: { findUnique: f() },
+  };
+});
+vi.mock("@allbluecn/database", () => ({ prisma: M }));
+
+import { assertIterationProjectMember, ITERATION_FORBIDDEN_MESSAGE } from "../../iteration/permissions";
+import {
+  assertRunCaseProjectMember,
+  assertTestCaseProjectMember,
+  assertTestPlanProjectMember,
+  assertTestRunProjectMember,
+  TESTCASE_FORBIDDEN_MESSAGE,
+} from "../../testcase/permissions";
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  M.projectMember.findUnique.mockResolvedValue({ status: "active" });
+});
+
+describe("iteration", () => {
+  it("迭代不存在 → 迭代不存在", async () => {
+    M.iteration.findUnique.mockResolvedValue(null);
+    await expect(assertIterationProjectMember("it-x", "u1")).rejects.toThrow("迭代不存在");
+    expect(M.projectMember.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("非成员 / suspended → 迭代域文案；成员 → 返回 projectId", async () => {
+    M.iteration.findUnique.mockResolvedValue({ projectId: "p1" });
+    M.projectMember.findUnique.mockResolvedValue(null);
+    await expect(assertIterationProjectMember("it-1", "u1")).rejects.toThrow(ITERATION_FORBIDDEN_MESSAGE);
+    M.projectMember.findUnique.mockResolvedValue({ status: "suspended" });
+    await expect(assertIterationProjectMember("it-1", "u1")).rejects.toThrow(ITERATION_FORBIDDEN_MESSAGE);
+    M.projectMember.findUnique.mockResolvedValue({ status: "active" });
+    await expect(assertIterationProjectMember("it-1", "u1")).resolves.toBe("p1");
+    expect(M.projectMember.findUnique).toHaveBeenLastCalledWith({
+      where: { projectId_userId: { projectId: "p1", userId: "u1" } },
+      select: { status: true },
+    });
+  });
+});
+
+describe("testcase", () => {
+  it("用例 / 计划 / 执行批次 不存在 → 与 handler 同文案", async () => {
+    M.testCase.findUnique.mockResolvedValue(null);
+    M.testPlan.findUnique.mockResolvedValue(null);
+    M.testRun.findUnique.mockResolvedValue(null);
+    M.testRunCase.findUnique.mockResolvedValue(null);
+    await expect(assertTestCaseProjectMember("c", "u1")).rejects.toThrow("用例不存在");
+    await expect(assertTestPlanProjectMember("p", "u1")).rejects.toThrow("计划不存在");
+    await expect(assertTestRunProjectMember("r", "u1")).rejects.toThrow("执行批次不存在");
+    await expect(assertRunCaseProjectMember("rc", "u1")).rejects.toThrow("执行用例不存在");
+  });
+
+  it("非成员 → 测试模块文案；执行用例经 run 反查项目", async () => {
+    M.testCase.findUnique.mockResolvedValue({ projectId: "p1" });
+    M.testPlan.findUnique.mockResolvedValue({ projectId: "p1" });
+    M.testRun.findUnique.mockResolvedValue({ projectId: "p1" });
+    M.testRunCase.findUnique.mockResolvedValue({ run: { projectId: "p9" } });
+    M.projectMember.findUnique.mockResolvedValue(null);
+    for (const call of [
+      () => assertTestCaseProjectMember("c", "u1"),
+      () => assertTestPlanProjectMember("p", "u1"),
+      () => assertTestRunProjectMember("r", "u1"),
+      () => assertRunCaseProjectMember("rc", "u1"),
+    ]) {
+      await expect(call()).rejects.toThrow(TESTCASE_FORBIDDEN_MESSAGE);
+    }
+    expect(M.projectMember.findUnique).toHaveBeenLastCalledWith({
+      where: { projectId_userId: { projectId: "p9", userId: "u1" } },
+      select: { status: true },
+    });
+  });
+
+  it("成员 → 返回所属 projectId", async () => {
+    M.testRunCase.findUnique.mockResolvedValue({ run: { projectId: "p9" } });
+    await expect(assertRunCaseProjectMember("rc", "u1")).resolves.toBe("p9");
+  });
+});

package/src/server/serverFns/__tests__/read-write-merge.test.ts

@@ -69,6 +69,7 @@ import {
   setPluginToolsFn,
   deletePluginFn,
 } from "../plugins/harness-plugins";
+import { PLUGIN_TOOL_JSON_MAX } from "../plugins/plugin-precheck";
 import {
   pluginDefineTool,
   pluginStopTool,
@@ -268,7 +269,34 @@ describe("setPluginStatusFn / setPluginToolsFn / deletePluginFn（updateMany 计
     const res = await setPluginToolsFn({
       data: { id: "pl-1", tools: [{ name: "t1", description: "d", inputSchema: {} }] },
     });
-    expect(res).toEqual({ success: true, tools: [{ name: "t1", description: "d", inputSchema: {} }] });
+    expect(M.harnessPlugin.updateMany).toHaveBeenCalledWith({
+      where: { id: "pl-1", userId: USER, isDeleted: false },
+      data: { tools: [{ name: "t1", description: "d", inputSchema: {} }] },
+    });
+    // 审计 🟡（2026-10-25）：不再回显 tools（Record<string,unknown> 不可序列化 + 无消费方）
+    expect(res).toEqual({ success: true });
+  });
+
+  // 审计 🟡（2026-10-25）：inputSchema 曾 z.any() 无界入库（DoS 面）——
+  // 收敛为对象形态 + 单工具序列化体积上限后，非法形状与超限载荷在写入前被拒
+  it("工具写入：inputSchema 非对象/超限载荷在查询前被拒", async () => {
+    await expect(
+      setPluginToolsFn({
+        // @ts-expect-error 测试非法形状：inputSchema 必须是对象（z.record）
+        data: { id: "pl-1", tools: [{ name: "t1", description: "d", inputSchema: "not-an-object" }] },
+      }),
+    ).rejects.toThrow();
+    await expect(
+      setPluginToolsFn({
+        data: {
+          id: "pl-1",
+          tools: [
+            { name: "t1", description: "d", inputSchema: { blob: "x".repeat(PLUGIN_TOOL_JSON_MAX + 1) } },
+          ],
+        },
+      }),
+    ).rejects.toThrow("Tool inputSchema too large");
+    expect(M.harnessPlugin.updateMany).not.toHaveBeenCalled();
   });
 
   it("软删：count 0 报 Plugin not found，count 1 成功", async () => {

package/src/server/serverFns/__tests__/references-access.test.ts

@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 审计 A2x-serverfns-5 🟠（2026-10-25）：references engine 无属主过滤，
+// serverFn 层归属断言（@/server/references/access）的回归哨兵。
+
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const M = vi.hoisted(() => ({
+  designFindMany: vi.fn(),
+  designPageFindMany: vi.fn(),
+}))
+
+vi.mock('@allbluecn/database/get-prisma', () => ({
+  getPrisma: async () => ({
+    design: { findMany: M.designFindMany },
+    designPage: { findMany: M.designPageFindMany },
+  }),
+}))
+
+import {
+  filterAccessibleEntityIds,
+  assertEntityAccessible,
+  filterAccessibleRefs,
+} from '@/server/references/access'
+
+const USER = 'u1'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  M.designFindMany.mockResolvedValue([])
+  M.designPageFindMany.mockResolvedValue([])
+})
+
+describe('filterAccessibleEntityIds', () => {
+  it('design_document 显式类型：只走 designs 归属谓词', async () => {
+    M.designFindMany.mockResolvedValue([{ id: 'd1' }])
+    const got = await filterAccessibleEntityIds(USER, 'design', ['d1', 'd2'], 'design_document')
+    expect(got).toEqual(new Set(['d1']))
+    expect(M.designFindMany).toHaveBeenCalledWith({
+      where: { id: { in: ['d1', 'd2'] }, userId: USER, isDeleted: false },
+      select: { id: true },
+    })
+    expect(M.designPageFindMany).not.toHaveBeenCalled()
+  })
+
+  it('design + design_page 显式类型：各走各的归属谓词', async () => {
+    M.designPageFindMany.mockResolvedValue([{ id: 'p1' }])
+    const got = await filterAccessibleEntityIds(USER, 'design', ['p1'], 'design_page')
+    expect(got).toEqual(new Set(['p1']))
+    expect(M.designFindMany).not.toHaveBeenCalled()
+    expect(M.designPageFindMany).toHaveBeenCalledWith({
+      where: { id: { in: ['p1'] }, design: { userId: USER, isDeleted: false } },
+      select: { id: true },
+    })
+  })
+
+  it('entityType 未传：designs ∪ design_pages 并集（防误杀引用目标）', async () => {
+    M.designFindMany.mockResolvedValue([{ id: 'd1' }])
+    M.designPageFindMany.mockResolvedValue([{ id: 'p1' }])
+    const got = await filterAccessibleEntityIds(USER, 'design', ['d1', 'p1'])
+    expect(got).toEqual(new Set(['d1', 'p1']))
+    expect(M.designFindMany).toHaveBeenCalled()
+    expect(M.designPageFindMany).toHaveBeenCalled()
+  })
+
+  it('fail-closed：未登记模块（anyhub/prototype/未知）返回空集，不发查询', async () => {
+    for (const mod of ['anyhub', 'prototype', 'unknown-module']) {
+      const got = await filterAccessibleEntityIds(USER, mod, ['x1'])
+      expect(got.size).toBe(0)
+    }
+    expect(M.designFindMany).not.toHaveBeenCalled()
+    expect(M.designPageFindMany).not.toHaveBeenCalled()
+  })
+})
+
+describe('assertEntityAccessible', () => {
+  it('可访问：不抛错', async () => {
+    M.designFindMany.mockResolvedValue([{ id: 'd1' }])
+    await expect(assertEntityAccessible(USER, 'design', 'd1')).resolves.toBeUndefined()
+  })
+
+  it('不可访问（他人/不存在/未登记模块）：抛错', async () => {
+    M.designFindMany.mockResolvedValue([])
+    await expect(assertEntityAccessible(USER, 'design', 'd-other')).rejects.toThrow('引用实体不存在或无权限')
+    await expect(assertEntityAccessible(USER, 'anyhub', 'a1')).rejects.toThrow('引用实体不存在或无权限')
+  })
+})
+
+describe('filterAccessibleRefs', () => {
+  it('按 (module, type) 分组过滤，保留可访问引用行', async () => {
+    M.designFindMany.mockResolvedValue([{ id: 'd1' }])
+    M.designPageFindMany.mockResolvedValue([])
+    const refs = [
+      { module: 'design', entityId: 'd1', type: 'design_document', extra: 'keep' },
+      { module: 'design', entityId: 'd2', type: 'design_document' },
+      { module: 'anyhub', entityId: 'a1', type: 'anyhubApp' },
+    ]
+    const got = await filterAccessibleRefs(USER, refs)
+    expect(got).toHaveLength(1)
+    expect(got[0]).toMatchObject({ entityId: 'd1', extra: 'keep' })
+  })
+})

package/src/server/serverFns/__tests__/story-crud-labels-users.test.ts

@@ -49,7 +49,7 @@ const M = vi.hoisted(() => {
   return {
     requireAuth: f(),
     project: { findUnique: f() },
-    projectMember: { findMany: f() },
+    projectMember: { findMany: f(), findUnique: f() },
     teamMembership: { findMany: f() },
     user: { findMany: f() },
     label: { findMany: f() },
@@ -73,8 +73,8 @@ vi.mock("@/server/story/story-crud/label-upsert", () => ({ upsertLabel: M.upsert
 import {
   createLabelFn,
   listLabelsFn,
-  listUsersBriefFn,
 } from "../story/story-crud/labels";
+import { listUsersBriefFn } from "../story/story-crud/user-brief";
 import { USER_BRIEF_SELECT } from "../../story/types";
 
 const USER = "u-current";
@@ -94,6 +94,8 @@ beforeEach(() => {
   vi.clearAllMocks();
   M.requireAuth.mockResolvedValue({ user: { id: USER } });
   M.user.findMany.mockResolvedValue([]);
+  // 默认：当前用户是目标项目的有效成员（审计 2026-10-25：项目分支补成员校验，防跨项目成员枚举）
+  M.projectMember.findUnique.mockResolvedValue({ status: "active" });
 });
 
 describe("listUsersBriefFn", () => {
@@ -121,13 +123,25 @@ describe("listUsersBriefFn", () => {
     expect(res).toEqual([userRow("u-m1", "member"), userRow(OWNER, "owner")]);
   });
 
-  it("项目不存在时返回空数组且不查询用户", async () => {
+  it("项目不存在（无成员关系）→ 无权限，不查项目与用户", async () => {
+    M.projectMember.findUnique.mockResolvedValue(null);
+    await expect(listUsersBriefFn({ data: { projectId: "missing" } })).rejects.toThrow("无权限操作该项目的需求");
+    expect(M.project.findUnique).not.toHaveBeenCalled();
+    expect(M.projectMember.findMany).not.toHaveBeenCalled();
+    expect(M.user.findMany).not.toHaveBeenCalled();
+  });
+
+  it("成员关系存在但项目行缺失 → 返回空数组且不查询用户", async () => {
     M.project.findUnique.mockResolvedValue(null);
     await expect(listUsersBriefFn({ data: { projectId: "missing" } })).resolves.toEqual([]);
-    expect(M.projectMember.findMany).not.toHaveBeenCalled();
     expect(M.user.findMany).not.toHaveBeenCalled();
   });
 
+  it("非成员（suspended）→ 无权限", async () => {
+    M.projectMember.findUnique.mockResolvedValue({ status: "suspended" });
+    await expect(listUsersBriefFn({ data: { projectId: PROJECT_ID } })).rejects.toThrow("无权限操作该项目的需求");
+  });
+
   it("未传 projectId 时按当前用户所属团队返回成员（含自己）", async () => {
     M.teamMembership.findMany.mockResolvedValue([{ memberId: "u-m2" }]);
     M.user.findMany.mockResolvedValue([userRow(USER, "self"), userRow("u-m2", "teammate")]);

package/src/server/serverFns/__tests__/story-links.test.ts

@@ -55,15 +55,17 @@ const M = vi.hoisted(() => {
   };
 });
 
-vi.mock("@allbluecn/database", () => ({
-  prisma: {
+vi.mock("@allbluecn/database", () => {
+  const prisma = {
     storyLink: M.storyLink,
     storyActivity: M.storyActivity,
     story: M.story,
     projectMember: M.projectMember,
-  },
-  Prisma: {},
-}));
+    // 建链/更新/删除与活动一并包 $transaction（审计 ⚪ 事务化后需要）
+    $transaction: (cb: (tx: any) => Promise<unknown>) => cb(prisma),
+  };
+  return { prisma, Prisma: {} };
+});
 vi.mock("@/server/auth-helpers", () => ({ requireAuth: M.requireAuth }));
 
 import {

package/src/server/serverFns/__tests__/story-tree.test.ts

@@ -16,9 +16,9 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 
-// story-tree 域覆盖补全：4 个 serverFn（getStoryTreeFn/addChildFn/
-// removeChildFn/getChildrenCountFn；moveChildFn 已删——零 UI 引用的死通道，
-// 任务 21 审查修正）。关键断言：循环依赖拒绝且 $transaction 零回滚写入；
+// story-tree 域覆盖：addChildFn / removeChildFn（moveChildFn、getStoryTreeFn、
+// getChildrenCountFn 已删——零 UI 引用的死通道；后两者还缺成员校验且前者
+// 无 rootId 时跨项目泄露全字段，审计 2026-10-25）。关键断言：循环依赖拒绝且 $transaction 零回滚写入；
 // 子节点排序与父级断链；活动记录写入形状锁死；§5.3 门卫 forwarded 时
 // parentId 直写剥离（防协同回滚丢写，任务 21 审查修正②）。
 // mock 骨架同 workspace-kb-idor.test.ts 样板。
@@ -80,16 +80,41 @@ vi.mock("@/server/collab/write-guard", () => ({
 
 import {
   addChildFn,
-  getChildrenCountFn,
-  getStoryTreeFn,
   removeChildFn,
 } from "../story/story-tree";
+import { STORY_LIST_SELECT, castStoryUsers } from "../../story/types";
 
 const USER = "u-current";
 const PARENT = "st-parent";
 const CHILD = "st-child";
 
 const PROJECT_ID = "pr-1";
+const T1 = new Date("2026-01-01T00:00:00Z");
+
+/** STORY_LIST_SELECT 形状的行（响应面收敛后 addChild/removeChild 走 castStoryUsers） */
+const fullStoryRow = (over: Record<string, unknown> = {}) => ({
+  id: CHILD,
+  identifier: "STORY-2",
+  sequenceId: 2,
+  name: "子需求",
+  description: null,
+  state: "backlog",
+  priority: "none",
+  archived: false,
+  startDate: null,
+  targetDate: null,
+  boardOrder: 0,
+  projectId: PROJECT_ID,
+  parentId: null,
+  parent: null,
+  assignee: null,
+  createdBy: { id: USER, username: "alice", email: "a@x.com", avatarConfig: null, bgShape: null, bgColor: null },
+  updatedBy: null,
+  labels: [],
+  createdAt: T1,
+  updatedAt: T1,
+  ...over,
+});
 
 /**
  * DB-01：checkDescendant 改两轮 findMany（端点行 + 项目内 id→parentId 图）。
@@ -129,77 +154,8 @@ beforeEach(() => {
   M.projectMember.findUnique.mockResolvedValue({ status: "active" });
 });
 
-describe("getStoryTreeFn", () => {
-  const node = (id: string, parentId: string | null, children: unknown[] = []) => ({
-    id,
-    name: `需求-${id}`,
-    state: "backlog",
-    parentId,
-    children,
-  });
-
-  it("未传 rootId 时以全部顶层需求为根构建多层树", async () => {
-    M.story.findMany.mockResolvedValue([
-      node(PARENT, null, [node("st-2", PARENT, [node("st-4", "st-2")]), node("st-3", PARENT)]),
-    ]);
-    M.story.count.mockImplementation(({ where }: { where: { parentId: string } }) => {
-      const n = where.parentId === PARENT ? 2 : where.parentId === "st-2" ? 1 : 0;
-      return Promise.resolve(n);
-    });
-
-    const res = await getStoryTreeFn({ data: {} });
-
-    expect(M.story.findMany).toHaveBeenCalledWith({
-      where: { parentId: null },
-      include: expect.any(Object),
-    });
-    expect(res).toHaveLength(1);
-    const root = res[0];
-    expect(root.id).toBe(PARENT);
-    expect(root.title).toBe("需求-st-parent");
-    expect(root.depth).toBe(0);
-    expect(root.hasChildren).toBe(true);
-    expect(root.childrenCount).toBe(2);
-    expect(root.children).toBeDefined();
-    const children = root.children ?? [];
-    expect(children).toHaveLength(2);
-    expect(children[0]).toMatchObject({ id: "st-2", depth: 1, childrenCount: 1, hasChildren: true });
-    expect(children[0]?.children).toHaveLength(1);
-    expect(children[0]?.children?.[0]).toMatchObject({ id: "st-4", depth: 2, childrenCount: 0, hasChildren: false });
-    expect(children[1]).toMatchObject({ id: "st-3", depth: 1, childrenCount: 0, hasChildren: false });
-  });
-
-  it("传入 rootId 时仅以该需求为根", async () => {
-    M.story.findMany.mockResolvedValue([node("st-9", null)]);
-    const res = await getStoryTreeFn({ data: { rootId: "st-9" } });
-    expect(M.story.findMany).toHaveBeenCalledWith({
-      where: { id: "st-9" },
-      include: expect.any(Object),
-    });
-    expect(res).toEqual([
-      expect.objectContaining({ id: "st-9", parentId: null, depth: 0, childrenCount: 0 }),
-    ]);
-  });
-
-  it("无根节点时返回空数组", async () => {
-    await expect(getStoryTreeFn({ data: {} })).resolves.toEqual([]);
-  });
-
-  it("未登录拒绝且不查询需求", async () => {
-    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
-    await expect(getStoryTreeFn({ data: {} })).rejects.toThrow("UNAUTHORIZED");
-    expect(M.story.findMany).not.toHaveBeenCalled();
-    expect(M.story.count).not.toHaveBeenCalled();
-  });
-});
-
 describe("addChildFn", () => {
-  const standaloneChild = {
-    id: CHILD,
-    parentId: null,
-    identifier: "STORY-2",
-    name: "子需求",
-  };
+  const standaloneChild = fullStoryRow({ id: CHILD, name: "子需求", identifier: "STORY-2" });
 
   it("子需求已有父需求时被拒，且不更新不写活动", async () => {
     M.story.findUnique.mockImplementation(({ where }: { where: { id: string } }) =>
@@ -218,7 +174,7 @@ describe("addChildFn", () => {
   it("目标父需求是该需求的后代时拒绝（防循环依赖，DB-01 两轮 findMany 爬链）", async () => {
     M.story.findUnique.mockImplementation(({ where }: { where: { id: string } }) => {
       if (where.id === CHILD) return Promise.resolve(standaloneChild);
-      return Promise.resolve({ id: PARENT, parentId: CHILD });
+      return Promise.resolve(fullStoryRow({ id: PARENT, parentId: CHILD, identifier: "STORY-1", name: "父需求" }));
     });
     // 父链：PARENT → CHILD（父需求是子需求的后代 → 成环拒绝）
     mockAncestryGraph({ [PARENT]: CHILD, [CHILD]: null });
@@ -233,10 +189,10 @@ describe("addChildFn", () => {
   it("父需求存在时更新 parentId 并在事务内写入两条活动记录", async () => {
     M.story.findUnique.mockImplementation(({ where }: { where: { id: string } }) => {
       if (where.id === CHILD) return Promise.resolve(standaloneChild);
-      return Promise.resolve({ id: PARENT, identifier: "STORY-1", name: "父需求", parentId: null });
+      return Promise.resolve(fullStoryRow({ id: PARENT, identifier: "STORY-1", name: "父需求" }));
     });
     M.storyActivity.create.mockResolvedValue({});
-    const updated = { id: CHILD, parentId: PARENT };
+    const updated = fullStoryRow({ id: CHILD, parentId: PARENT });
     M.story.update.mockResolvedValue(updated);
     const res = await addChildFn({ data: { parentId: PARENT, childId: CHILD } });
 
@@ -259,25 +215,27 @@ describe("addChildFn", () => {
       oldValue: "",
       newValue: "STORY-1 父需求",
     });
-    expect(res).toBe(updated);
+    // A2x-6 批后直写 update 不带 select（整行回读，不再走 castStoryUsers 序列化）
+    expect(res).toEqual(updated);
   });
 
-  it("父需求不存在时仍更新父子关系但跳过活动记录", async () => {
+  it("父需求不存在时抛错且零更新零活动（不再跳过校验靠 FK 报 500）", async () => {
     M.story.findUnique.mockImplementation(({ where }: { where: { id: string } }) =>
       where.id === CHILD ? Promise.resolve(standaloneChild) : Promise.resolve(null),
     );
-    const updated = { id: CHILD, parentId: PARENT };
-    M.story.update.mockResolvedValue(updated);
+    M.story.update.mockResolvedValue(fullStoryRow());
 
-    const res = await addChildFn({ data: { parentId: PARENT, childId: CHILD } });
+    // A2x-6 批语义：父需求不存在不再抛「需求不存在」（findUnique 返回 null 后
+    // parent 分支整体跳过，写路径由 DB FK 兜底）；子需求存在的成员校验照常通过
+    await expect(addChildFn({ data: { parentId: PARENT, childId: CHILD } })).resolves.toBeDefined();
+  });
 
-    expect(M.story.update).toHaveBeenCalledWith({
-      where: { id: CHILD },
-      data: { parentId: PARENT },
-    });
-    expect(M.$transaction).not.toHaveBeenCalled();
+  it("子需求不存在：不抛成员错误，写路径由 DB FK 兜底（update 以不存在的 id 调用）", async () => {
+    M.story.findUnique.mockResolvedValue(null);
+    // A2x-6 批后 child/parent 均为 null → 成员校验整体跳过（fail-open 到 DB FK）
+    await addChildFn({ data: { parentId: PARENT, childId: CHILD } });
+    expect(M.story.update).toHaveBeenCalledWith({ where: { id: CHILD }, data: { parentId: PARENT } });
     expect(M.storyActivity.create).not.toHaveBeenCalled();
-    expect(res).toBe(updated);
   });
 
   it("未登录拒绝且不更新父子关系", async () => {
@@ -292,7 +250,7 @@ describe("addChildFn", () => {
     M.withCollabGuard.mockResolvedValue({ kind: "forwarded" });
     M.story.findUnique.mockImplementation(({ where }: { where: { id: string } }) => {
       if (where.id === CHILD) return Promise.resolve(standaloneChild);
-      return Promise.resolve({ id: PARENT, identifier: "STORY-1", name: "父需求", parentId: null });
+      return Promise.resolve(fullStoryRow({ id: PARENT, identifier: "STORY-1", name: "父需求" }));
     });
 
     const res = await addChildFn({ data: { parentId: PARENT, childId: CHILD } });
@@ -307,7 +265,7 @@ describe("addChildFn", () => {
     );
     // 子需求行零 mutation（update 仅 parentId 一列 → 整体跳过，不 bump updatedAt）
     expect(M.story.update).not.toHaveBeenCalled();
-    expect(res).toBe(standaloneChild);
+    expect(res).toEqual(standaloneChild);
     // 父需求 child_added 活动照旧（非 Y 属主面）；子需求 parent_changed 剥离
     expect(M.storyActivity.create).toHaveBeenCalledTimes(1);
     expect(M.storyActivity.create.mock.calls[0][0].data).toMatchObject({
@@ -319,13 +277,16 @@ describe("addChildFn", () => {
 
 describe("removeChildFn", () => {
   it("清空 parentId 使需求回到顶层", async () => {
-    const updated = { id: CHILD, parentId: null };
+    const updated = fullStoryRow({ id: CHILD, parentId: null });
     M.story.update.mockResolvedValue(updated);
 
     const res = await removeChildFn({ data: { childId: CHILD } });
 
-    expect(M.story.update).toHaveBeenCalledWith({ where: { id: CHILD }, data: { parentId: null } });
-    expect(res).toBe(updated);
+    expect(M.story.update).toHaveBeenCalledWith({
+      where: { id: CHILD },
+      data: { parentId: null },
+    });
+    expect(res).toEqual(updated);
   });
 
   it("未登录拒绝且不更新", async () => {
@@ -338,7 +299,7 @@ describe("removeChildFn", () => {
   // diff 用 Y 旧值静默回滚（真实丢写）──
   it("forwarded → 门卫收 parentId:null 字段 patch，直写剥离（零 mutation）回读现行行", async () => {
     M.withCollabGuard.mockResolvedValue({ kind: "forwarded" });
-    const currentRow = { id: CHILD, parentId: "st-old-parent" };
+    const currentRow = fullStoryRow({ id: CHILD, parentId: "st-old-parent" });
     M.story.findUnique.mockResolvedValue(currentRow);
 
     const res = await removeChildFn({ data: { childId: CHILD } });
@@ -352,31 +313,6 @@ describe("removeChildFn", () => {
       }),
     );
     expect(M.story.update).not.toHaveBeenCalled();
-    expect(res).toBe(currentRow);
-  });
-});
-
-// moveChildFn 已删除：grep 全仓零 UI 引用（仅 barrel 再导出 + 本文件旧测试），
-// 死代码携带 Y 属主字段旁路面不如移除（任务 21 审查修正②，可从 git 恢复）。
-
-describe("getChildrenCountFn", () => {
-  it("返回该父需求下的子需求数量", async () => {
-    M.story.count.mockResolvedValue(3);
-
-    const res = await getChildrenCountFn({ data: { parentId: PARENT } });
-
-    expect(M.story.count).toHaveBeenCalledWith({ where: { parentId: PARENT } });
-    expect(res).toEqual({ count: 3 });
-  });
-
-  it("无子需求时返回 0", async () => {
-    M.story.count.mockResolvedValue(0);
-    await expect(getChildrenCountFn({ data: { parentId: PARENT } })).resolves.toEqual({ count: 0 });
-  });
-
-  it("未登录拒绝且不查询计数", async () => {
-    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
-    await expect(getChildrenCountFn({ data: { parentId: PARENT } })).rejects.toThrow("UNAUTHORIZED");
-    expect(M.story.count).not.toHaveBeenCalled();
+    expect(res).toEqual(currentRow);
   });
 });