@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/agents/skill-crud.ts

@@ -19,17 +19,10 @@ import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start"
 import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
-import { getCurrentSession } from "@/lib/session"
 import { requireFeature } from "@/server/entitlements"
 import { requireResource } from "@/server/resources"
-
-type SessionUser = { id?: string }
-
-async function requireSessionUser(request: Request | undefined): Promise<string> {
-  const session = await getCurrentSession(request)
-  if (!session?.user?.id) throw new Error("未登录")
-  return session.user.id
-}
+import { requireUserId } from "@/server/auth-helpers"
+import { SKILL_NAME_CONFLICT_CODE } from "@/lib/agents/skill-errors"
 
 const NAME_REGEX = /^[a-z0-9-]+$/
 
@@ -39,27 +32,50 @@ const skillInputSchema = z.object({
   template: z.string().min(1).max(4000),
 })
 
-type SkillInput = z.infer<typeof skillInputSchema>
+type SkillRow = {
+  id: string
+  userId: string
+  name: string
+  title: string
+  template: string
+  createdAt: Date
+  updatedAt: Date
+}
+
+function toSkillDTO(s: SkillRow) {
+  return {
+    id: s.id,
+    userId: s.userId,
+    name: s.name,
+    title: s.title,
+    template: s.template,
+    createdAt: s.createdAt,
+    updatedAt: s.updatedAt,
+  }
+}
+
+const SKILL_DTO_SELECT = {
+  id: true,
+  userId: true,
+  name: true,
+  title: true,
+  template: true,
+  createdAt: true,
+  updatedAt: true,
+} as const
 
 export const listSkillsFn = createServerFn({ method: "GET" }).handler(async () => {
     const prisma = await getPrisma()
   const request = getRequest()
-  const userId = await requireSessionUser(request)
+  const userId = await requireUserId(request)
 
   const skills = await prisma.userSkill.findMany({
     where: { userId, isDeleted: false },
     orderBy: { updatedAt: "desc" },
+    select: SKILL_DTO_SELECT,
   })
 
-  return skills.map((s) => ({
-    id: s.id,
-    userId: s.userId,
-    name: s.name,
-    title: s.title,
-    template: s.template,
-    createdAt: s.createdAt,
-    updatedAt: s.updatedAt,
-  }))
+  return skills.map(toSkillDTO)
 })
 
 export const createSkillFn = createServerFn({ method: "POST" })
@@ -67,7 +83,7 @@ export const createSkillFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const userId = await requireSessionUser(request)
+    const userId = await requireUserId(request)
 
     await requireFeature(request, "customAgents")
     await requireResource(request, "skillQuota", 1)
@@ -80,20 +96,14 @@ export const createSkillFn = createServerFn({ method: "POST" })
           title: data.title,
           template: data.template,
         },
+        select: SKILL_DTO_SELECT,
       })
 
-      return {
-        id: skill.id,
-        userId: skill.userId,
-        name: skill.name,
-        title: skill.title,
-        template: skill.template,
-        createdAt: skill.createdAt,
-        updatedAt: skill.updatedAt,
-      }
+      return toSkillDTO(skill)
     } catch (err: any) {
       if (err?.code === "P2002") {
-        throw new Error(`技能「${data.name}」已存在`)
+        // 稳定 code 前缀供客户端按码分支（文案嗅探已废弃，见 lib/agents/skill-errors）
+        throw new Error(`${SKILL_NAME_CONFLICT_CODE}: 技能「${data.name}」已存在`)
       }
       throw err
     }
@@ -106,22 +116,15 @@ export const getSkillFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const userId = await requireSessionUser(request)
+    const userId = await requireUserId(request)
 
     const skill = await prisma.userSkill.findFirst({
       where: { id: data.id, userId, isDeleted: false },
+      select: SKILL_DTO_SELECT,
     })
     if (!skill) return null
 
-    return {
-      id: skill.id,
-      userId: skill.userId,
-      name: skill.name,
-      title: skill.title,
-      template: skill.template,
-      createdAt: skill.createdAt,
-      updatedAt: skill.updatedAt,
-    }
+    return toSkillDTO(skill)
   })
 
 const skillUpdateSchema = z.object({
@@ -150,12 +153,12 @@ export const updateSkillFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const userId = await requireSessionUser(request)
+    const userId = await requireUserId(request)
 
     // DB-03：属主校验合并进写入（updateMany 计数判定），1 次查询替代 2 次
     const update = buildSkillUpdatePayload(data)
     const res = await prisma.userSkill.updateMany({
-      where: { id: data.id, userId },
+      where: { id: data.id, userId, isDeleted: false },
       data: update,
     })
     if (res.count === 0) {
@@ -172,11 +175,11 @@ export const deleteSkillFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const userId = await requireSessionUser(request)
+    const userId = await requireUserId(request)
 
     // DB-03：属主校验合并进写入（updateMany 计数判定）
     const res = await prisma.userSkill.updateMany({
-      where: { id: data.id, userId },
+      where: { id: data.id, userId, isDeleted: false },
       data: { isDeleted: true },
     })
     if (res.count === 0) {

package/src/server/serverFns/ai/code-mode-readiness.ts

@@ -16,8 +16,14 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from "@tanstack/react-start"
-import { getCodeModeReadiness } from "../../ai-gateway/code-mode"
+import { getRequest } from "@tanstack/react-start/server"
+import { getCodeModeReadiness } from "@/server/ai-gateway/code-mode"
+import { requireUserId } from "@/server/auth-helpers"
 
+// 仅面向已登录的 harness 工作台（useCodeModeReadiness 消费方），非公开端点
 export const getCodeModeReadinessFn = createServerFn({ method: "GET" }).handler(
-  async () => getCodeModeReadiness(),
+  async () => {
+    await requireUserId(getRequest())
+    return getCodeModeReadiness()
+  },
 )

package/src/server/serverFns/ai/search-capability.ts

@@ -16,8 +16,14 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from "@tanstack/react-start"
-import { isSearxngEnabled } from "../web-search"
+import { getRequest } from "@tanstack/react-start/server"
+import { isSearxngEnabled } from "@/server/web-search"
+import { requireUserId } from "@/server/auth-helpers"
 
+// 仅面向已登录的 harness 对话 UI（useSearchCapability 消费方），非公开端点
 export const getSearchCapabilityFn = createServerFn({ method: "GET" }).handler(
-  async () => ({ searxngEnabled: isSearxngEnabled() }),
+  async () => {
+    await requireUserId(getRequest())
+    return { searxngEnabled: isSearxngEnabled() }
+  },
 )

package/src/server/serverFns/analytics.ts

@@ -17,18 +17,22 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
+import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
 
+// 埋点占位实现（当前仅 console.log 不落库）；匿名可写但按 IP 限流 + 单批上限，
+// 防日志洪泛。正式落库时需按项目约定重命名为实际业务名并接配额。
 const analyticsEventSchema = z.object({
   events: z.array(z.object({
-    event: z.string(),
+    event: z.string().max(128),
     properties: z.record(z.string(), z.unknown()).optional(),
-    timestamp: z.string().optional(),
-  })),
+    timestamp: z.string().max(64).optional(),
+  })).max(50),
 })
 
 export const trackAnalyticsFn = createServerFn({ method: 'POST' })
   .validator(analyticsEventSchema)
   .handler(async ({ data }) => {
+    await checkAuthRateLimit('analytics', 30, 60 * 1000)
     for (const event of data.events) {
       console.log('[Analytics]', JSON.stringify(event))
 

package/src/server/serverFns/anyhub/app.ts

@@ -21,6 +21,26 @@ import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
 
+// DB-05：白名单 select（与 index.ts listAnyHubAppsFn 同一口径，防未来新增敏感列外泄）
+const ANY_HUB_APP_SELECT = {
+  id: true,
+  name: true,
+  displayName: true,
+  description: true,
+  version: true,
+  source: true,
+  url: true,
+  localPath: true,
+  proxyBasePath: true,
+  iconUrl: true,
+  pinned: true,
+  status: true,
+  userId: true,
+  githubUrl: true,
+  createdAt: true,
+  updatedAt: true,
+} as const
+
 export const getAnyHubAppFn = createServerFn({ method: 'GET' })
   .validator(z.object({ id: z.string() }))
   .handler(async ({ data }) => {
@@ -28,7 +48,8 @@ export const getAnyHubAppFn = createServerFn({ method: 'GET' })
     const request = getRequest()
     const session = await requireAuth(request)
     const app = await prisma.anyHubApp.findFirst({
-      where: { id: data.id, userId: session.user!.id! },
+      where: { id: data.id, userId: session.user.id },
+      select: ANY_HUB_APP_SELECT,
     })
     if (!app) throw new Error('应用不存在')
     return app
@@ -40,19 +61,16 @@ export const updateAnyHubAppFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const existing = await prisma.anyHubApp.findFirst({
-      where: { id: data.id, userId: session.user!.id! },
-      select: { version: true },
-    })
-    if (!existing) throw new Error('应用不存在')
-    return prisma.anyHubApp.update({
-      where: { id: data.id },
+    // DB-03：属主校验合并进写入（updateMany 计数判定）；version 由安装流程维护，此处不再回写原值
+    const res = await prisma.anyHubApp.updateMany({
+      where: { id: data.id, userId: session.user.id },
       data: {
-        version: existing.version,
         status: 'updating',
         updatedAt: new Date(),
       },
     })
+    if (res.count === 0) throw new Error('应用不存在')
+    return { success: true }
   })
 
 export const deleteAnyHubAppFn = createServerFn({ method: 'POST' })
@@ -61,11 +79,10 @@ export const deleteAnyHubAppFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const existing = await prisma.anyHubApp.findFirst({
-      where: { id: data.id, userId: session.user!.id! },
-      select: { id: true },
+    // DB-03：属主校验合并进删除（deleteMany 计数判定）
+    const res = await prisma.anyHubApp.deleteMany({
+      where: { id: data.id, userId: session.user.id },
     })
-    if (!existing) throw new Error('应用不存在')
-    await prisma.anyHubApp.delete({ where: { id: data.id } })
+    if (res.count === 0) throw new Error('应用不存在')
     return { success: true }
   })

package/src/server/serverFns/anyhub/index.ts

@@ -16,11 +16,32 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
+import type { Prisma } from "@allbluecn/database"
 import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
 
+// DB-05：白名单 select（消费方 AnyHubAppData 覆盖全部标量列，防未来新增敏感列外泄）
+const ANY_HUB_APP_SELECT = {
+  id: true,
+  name: true,
+  displayName: true,
+  description: true,
+  version: true,
+  source: true,
+  url: true,
+  localPath: true,
+  proxyBasePath: true,
+  iconUrl: true,
+  pinned: true,
+  status: true,
+  userId: true,
+  githubUrl: true,
+  createdAt: true,
+  updatedAt: true,
+} as const
+
 export const listAnyHubAppsFn = createServerFn({ method: 'GET' })
   .handler(async () => {
     const prisma = await getPrisma()
@@ -28,40 +49,24 @@ export const listAnyHubAppsFn = createServerFn({ method: 'GET' })
     const session = await requireAuth(request)
     // DB-05：白名单 select（消费方 AnyHubAppData 覆盖全部标量列，防未来新增敏感列外泄）
     return prisma.anyHubApp.findMany({
-      where: { userId: session.user!.id! },
+      where: { userId: session.user.id },
       orderBy: { createdAt: 'desc' },
-      select: {
-        id: true,
-        name: true,
-        displayName: true,
-        description: true,
-        version: true,
-        source: true,
-        url: true,
-        localPath: true,
-        proxyBasePath: true,
-        iconUrl: true,
-        pinned: true,
-        status: true,
-        userId: true,
-        githubUrl: true,
-        createdAt: true,
-        updatedAt: true,
-      },
+      select: ANY_HUB_APP_SELECT,
     })
   })
 
+// 市场目录：仅返回 status=PUBLISHED 的公开应用，定价/市场页公开语义（未登录可读，有意无鉴权）
 export const listMarketplaceAppsFn = createServerFn({ method: 'GET' })
   .validator(z.object({
-    category: z.string().optional(),
-    search: z.string().optional(),
+    category: z.string().max(64).optional(),
+    search: z.string().max(128).optional(),
   }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
-    const where: any = { status: 'PUBLISHED' }
+    const where: Prisma.AnyHubMarketAppWhereInput = { status: 'PUBLISHED' }
     if (data.category) where.category = data.category
     if (data.search) where.name = { contains: data.search, mode: 'insensitive' }
-    return prisma.anyHubMarketApp.findMany({
+    const rows = await prisma.anyHubMarketApp.findMany({
       where,
       orderBy: { downloads: 'desc' },
       select: {
@@ -77,7 +82,12 @@ export const listMarketplaceAppsFn = createServerFn({ method: 'GET' })
         capabilities: true,
         status: true,
       },
-    }) as any
+    })
+    // capabilities Json → 消费端 AnyHubMarketAppData 的 Record<string, boolean>
+    return rows.map((r) => ({
+      ...r,
+      capabilities: (r.capabilities ?? {}) as Record<string, boolean>,
+    }))
   })
 
 export const togglePinFn = createServerFn({ method: 'POST' })
@@ -86,13 +96,19 @@ export const togglePinFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const app = await prisma.anyHubApp.findFirst({
-      where: { id: data.appId, userId: session.user!.id! },
-      select: { pinned: true },
-    })
-    if (!app) throw new Error('应用不存在')
-    return prisma.anyHubApp.update({
-      where: { id: data.appId },
-      data: { pinned: !app.pinned },
+    const userId = session.user.id
+    // DB-03：读回 pinned + 条件写收进事务，写路径带 userId 谓词消除 TOCTOU
+    return prisma.$transaction(async (tx) => {
+      const app = await tx.anyHubApp.findFirst({
+        where: { id: data.appId, userId },
+        select: { pinned: true },
+      })
+      if (!app) throw new Error('应用不存在')
+      const next = { pinned: !app.pinned }
+      await tx.anyHubApp.updateMany({
+        where: { id: data.appId, userId },
+        data: next,
+      })
+      return next
     })
   })

package/src/server/serverFns/anyhub/install.ts

@@ -25,14 +25,27 @@ import { isLocalPathAllowed } from '@/lib/anyhub/local-path'
 
 const installSchema = z.object({
   source: z.enum(['marketplace', 'github', 'local']),
-  marketplaceAppId: z.string().optional(),
-  githubUrl: z.string().optional(),
-  localPath: z.string().optional(),
-  name: z.string().optional(),
-  displayName: z.string().optional(),
-  description: z.string().optional(),
+  marketplaceAppId: z.string().max(64).optional(),
+  githubUrl: z.string().max(2048).optional(),
+  localPath: z.string().max(1024).optional(),
+  name: z.string().max(128).optional(),
+  displayName: z.string().max(128).optional(),
+  description: z.string().max(1024).optional(),
 })
 
+/** github source 仅接受 https://github.com（含 www）域名的 URL，防任意串入库被下游拉取 */
+function assertGithubUrl(githubUrl: string): void {
+  let url: URL
+  try {
+    url = new URL(githubUrl)
+  } catch {
+    throw new Error('githubUrl 不是合法 URL')
+  }
+  if (url.protocol !== 'https:' || !['github.com', 'www.github.com'].includes(url.hostname)) {
+    throw new Error('githubUrl 必须是 https://github.com 域名下的 URL')
+  }
+}
+
 export const installAnyHubAppFn = createServerFn({ method: 'POST' })
   .validator(installSchema)
   .handler(async ({ data }) => {
@@ -42,6 +55,7 @@ export const installAnyHubAppFn = createServerFn({ method: 'POST' })
 
     if (data.source === 'marketplace' && !data.marketplaceAppId) throw new Error('缺少 marketplaceAppId')
     if (data.source === 'github' && !data.githubUrl) throw new Error('缺少 githubUrl')
+    if (data.source === 'github') assertGithubUrl(data.githubUrl!)
     if (data.source === 'local' && !data.localPath) throw new Error('缺少 localPath')
 
     // SEC-02/SEC-11：local source 严格白名单——拒绝任意 localPath 入库，
@@ -64,7 +78,7 @@ export const installAnyHubAppFn = createServerFn({ method: 'POST' })
         marketplaceAppId: data.source === 'marketplace' ? data.marketplaceAppId : undefined,
         githubUrl: data.source === 'github' ? data.githubUrl : undefined,
         localPath: resolvedLocalPath,
-        userId: session.user!.id!,
+        userId: session.user.id,
         status: 'installing',
       },
     })

package/src/server/serverFns/anyhub/permissions.ts

@@ -19,19 +19,21 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { getAppPermissions, grantPermission } from '@/lib/anyhub/permissions'
+import { getAppPermissions, grantPermission, checkPermission } from '@/lib/anyhub/permissions'
+import { ALL_CAPABILITIES } from '@/lib/anyhub/capabilities'
 
 export const getAnyHubPermissionsFn = createServerFn({ method: 'GET' })
   .validator(z.object({ id: z.string() }))
   .handler(async ({ data }) => {
     const request = getRequest()
     const session = await requireAuth(request)
-    return getAppPermissions(data.id, session.user!.id!)
+    return getAppPermissions(data.id, session.user.id)
   })
 
 const updatePermissionSchema = z.object({
   id: z.string(),
-  capability: z.string(),
+  // 收敛到能力常量表，拒绝任意字符串落库（防脏数据/大小写变体绕过判定）
+  capability: z.enum(ALL_CAPABILITIES as readonly string[]),
   granted: z.boolean(),
 })
 
@@ -40,6 +42,25 @@ export const updateAnyHubPermissionFn = createServerFn({ method: 'POST' })
   .handler(async ({ data }) => {
     const request = getRequest()
     const session = await requireAuth(request)
-    await grantPermission(data.id, data.capability, session.user!.id!, data.granted)
+    await grantPermission(data.id, data.capability, session.user.id, data.granted)
     return { success: true }
   })
+
+const checkPermissionSchema = z.object({
+  appId: z.string().min(1),
+  // bridge 方法名经 normalizeMethod 归一为冒号格式（如 prd:list）
+  method: z.string().min(1),
+})
+
+/**
+ * AnyHub iframe 消息桥的权限判定入口：权限表在 DB，浏览器无法直查（也不该把
+ * prisma 拉进客户端），桥在 postMessage 处理链中经此 serverFn 做 RPC 判定。
+ * userId 以 session 为准，不信任客户端传入值。
+ */
+export const checkAnyHubPermissionFn = createServerFn({ method: 'POST' })
+  .validator(checkPermissionSchema)
+  .handler(async ({ data }) => {
+    const request = getRequest()
+    const session = await requireAuth(request)
+    return checkPermission(data.appId, data.method, session.user.id)
+  })

package/src/server/serverFns/anyhub/proxy.ts

@@ -35,7 +35,7 @@ export const serveAnyHubFileFn = createServerFn({ method: 'POST' })
     const request = getRequest()
     const session = await requireAuth(request)
     const app = await prisma.anyHubApp.findFirst({
-      where: { id: data.appId, userId: session.user!.id! },
+      where: { id: data.appId, userId: session.user.id },
       select: { localPath: true },
     })
     if (!app) throw new Error('应用不存在')

package/src/server/serverFns/auth/email-verification.ts

@@ -28,9 +28,11 @@ const VERIFY_TOKEN_TTL_MS = 24 * 60 * 60 * 1000
 const appUrl = () => process.env.VITE_APP_URL ?? 'http://localhost:3000'
 
 export const confirmEmailVerificationFn = createServerFn({ method: 'GET' })
-  .validator(z.object({ token: z.string().min(1) }))
+  .validator(z.object({ token: z.string().min(1).max(256) }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
+    // 触发事务写 + 发欢迎信，与 resend 同口径按 IP 限流防刷
+    await checkAuthRateLimit('confirmVerify', 10, 15 * 60 * 1000)
     const row = await prisma.emailVerificationToken.findUnique({
       where: { token: data.token },
     })
@@ -94,6 +96,11 @@ export const resendVerificationEmailFn = createServerFn({ method: 'POST' })
     if (user.emailVerified) return { alreadyVerified: true }
 
     const token = generateEmailToken()
+    // 签发新 token 前先让旧 token 全部过期，保证同一账号同时至多一枚有效验证 token
+    await prisma.emailVerificationToken.updateMany({
+      where: { userId, usedAt: null },
+      data: { expiresAt: new Date() },
+    })
     await prisma.emailVerificationToken.create({
       data: {
         token,

package/src/server/serverFns/auth/forgot-password.ts

@@ -18,7 +18,7 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { randomBytes } from 'crypto'
+import { createHash, randomBytes } from 'crypto'
 import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
 import { sendTemplateEmail } from '@/server/email'
 
@@ -30,6 +30,11 @@ function generateToken(): string {
   return randomBytes(32).toString('hex')
 }
 
+/** DB 泄露即 token 可用 → 与 bug-access-tokens 同口径只落 sha256(token) */
+function hashToken(token: string): string {
+  return createHash('sha256').update(token).digest('hex')
+}
+
 export const forgotPasswordFn = createServerFn({ method: 'POST' })
   .validator(forgotPasswordSchema)
   .handler(async ({ data }) => {
@@ -47,7 +52,7 @@ export const forgotPasswordFn = createServerFn({ method: 'POST' })
       let created = false
       try {
         await prisma.passwordResetToken.create({
-          data: { token, userId: user.id, expiresAt },
+          data: { token: hashToken(token), userId: user.id, expiresAt },
         })
         created = true
       } catch (dbError) {

package/src/server/serverFns/auth/providers.ts

@@ -22,6 +22,8 @@ export interface AuthProvidersInfo {
   googleEnabled: boolean
 }
 
+// 登录/注册页渲染必需（_login 布局 loader）→ 有意公开，仅泄露 OAuth 启用布尔
+// （审计 2026-10-25 标注豁免）
 export const getAuthProviders = createServerFn({ method: 'GET' }).handler(async (): Promise<AuthProvidersInfo> => {
   const providers = await getResolvedOAuthProviders()
   return { googleEnabled: providers.some((p) => p.provider === 'google') }

package/src/server/serverFns/auth/register.ts

@@ -20,7 +20,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
 import bcrypt from 'bcryptjs'
 import { Prisma } from '@allbluecn/database'
-import { getRandomConfig, presetBgColors } from '@/components/settings/personal-team/account/avatar/avatar-config'
+import { getRandomConfig, presetBgColors } from '@/lib/avatar/avatar-config'
 import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
 import { getRegistrationMode, consumeInvitationCode } from '@/server/auth-registration'
 import { sendTemplateEmail, generateEmailToken } from '@/server/email'

package/src/server/serverFns/auth/registration-mode.ts

@@ -18,6 +18,8 @@
 import { createServerFn } from '@tanstack/react-start'
 import { getRegistrationMode } from '@/server/auth-registration'
 
+// 注册页渲染必需（未登录可访问注册页）→ 有意公开，仅泄露部署是否开启邀请制
+// （审计 2026-10-25 标注豁免）
 export const getRegistrationModeFn = createServerFn({ method: 'GET' }).handler(
   async () => ({ mode: await getRegistrationMode() }),
 )