@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/auth/reset-password.ts

@@ -18,20 +18,28 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
+import { createHash } from 'crypto'
 import bcrypt from 'bcryptjs'
 import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
 
+/** forgot-password 只落 sha256(token)，查询按 hash（与 bug-access-tokens 口径一致） */
+function hashToken(token: string): string {
+  return createHash('sha256').update(token).digest('hex')
+}
+
 const resetPasswordSchema = z.object({
-  token: z.string().min(1, 'Token is required'),
+  token: z.string().min(1, '缺少重置令牌').max(256),
   password: z.string().min(8, '密码至少 8 位').max(32).regex(/[a-zA-Z]/, '密码需包含字母').regex(/[0-9]/, '密码需包含数字'),
 })
 
 export const validateResetTokenFn = createServerFn({ method: 'GET' })
-  .validator(z.object({ token: z.string() }))
+  .validator(z.object({ token: z.string().min(1).max(256) }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
+    // 未认证逐 token 验证接口，按 IP 限流防刷
+    await checkAuthRateLimit('validateResetToken', 20, 15 * 60 * 1000)
     const resetToken = await prisma.passwordResetToken.findUnique({
-      where: { token: data.token },
+      where: { token: hashToken(data.token) },
       select: { usedAt: true, expiresAt: true },
     })
 
@@ -48,25 +56,28 @@ export const resetPasswordFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     await checkAuthRateLimit('resetPassword', 5, 15 * 60 * 1000)
     const resetToken = await prisma.passwordResetToken.findUnique({
-      where: { token: data.token },
+      where: { token: hashToken(data.token) },
       select: { id: true, userId: true, usedAt: true, expiresAt: true },
     })
-    if (!resetToken) throw new Error('Invalid token')
-    if (resetToken.usedAt) throw new Error('Token already used')
-    if (new Date() > resetToken.expiresAt) throw new Error('Token expired')
+    if (!resetToken) throw new Error('无效或已过期的重置链接')
+    if (resetToken.usedAt) throw new Error('重置链接已使用')
+    if (new Date() > resetToken.expiresAt) throw new Error('重置链接已过期')
 
     const hashedPassword = await bcrypt.hash(data.password, 12)
 
-    await prisma.$transaction([
-      prisma.user.update({
-        where: { id: resetToken.userId },
-        data: { password: hashedPassword },
-      }),
-      prisma.passwordResetToken.update({
-        where: { id: resetToken.id },
+    // 条件式 claim（usedAt:null 计数判定）先行占位，并发双请求仅一枚 token 生效
+    await prisma.$transaction(async (tx) => {
+      const claim = await tx.passwordResetToken.updateMany({
+        where: { id: resetToken.id, usedAt: null },
         data: { usedAt: new Date() },
-      }),
-    ])
+      })
+      if (claim.count === 0) throw new Error('重置链接已使用')
+      await tx.user.update({
+        where: { id: resetToken.userId },
+        // tokenVersion +1：session callback 比对 JWT 记账值不匹配即拒旧会话（密码重置必须吊销既有登录态）
+        data: { password: hashedPassword, tokenVersion: { increment: 1 } },
+      })
+    })
 
-    return { message: 'Password reset successfully' }
+    return { message: '密码重置成功' }
   })

package/src/server/serverFns/auth/session.ts

@@ -15,6 +15,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+import { DEFAULT_AI_MODEL, DEFAULT_AI_PROVIDER } from '@/lib/ai/default-model'
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
 import { getRequest } from '@tanstack/react-start/server'
@@ -25,20 +26,22 @@ import { buildGuestSession, isDesktopServer } from '@/server/desktop-guest'
 import { readRemoteAuth, writeRemoteAuth, writeRemoteSession, clearRemoteAuth } from '@/server/remote-auth'
 import { generateEntitlementsToken } from '@/server/entitlements-token'
 import type { RemoteAuthData } from '@/server/remote-auth'
+import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
 
 const SAAS_URL = process.env.DESKTOP_SAAS_URL || 'https://allblue.litsex.cn'
 
-interface SaaSProfileResponse {
-  user: {
-    id: string
-    name: string | null
-    email: string | null
-    role: string
-  }
-  planName?: string
-  features?: Record<string, boolean>
-  signedToken?: string
-}
+// 外部 SaaS 响应不信任形状：先 schema 校验再消费，字段缺失/类型漂移拒绝签发权益 token
+const saasProfileSchema = z.object({
+  user: z.object({
+    id: z.string().min(1),
+    name: z.string().nullable().optional(),
+    email: z.string().nullable().optional(),
+    role: z.string().optional(),
+  }),
+  planName: z.string().optional(),
+  features: z.record(z.string(), z.boolean()).optional(),
+  signedToken: z.string().optional(),
+})
 
 function buildRemoteSession(data: RemoteAuthData): Session {
   return {
@@ -48,8 +51,8 @@ function buildRemoteSession(data: RemoteAuthData): Session {
       email: data.email,
       role: (data.role ?? 'USER') as 'USER' | 'ADMIN' | 'SUPER_ADMIN',
       isGuest: false,
-      aiProvider: 'openrouter',
-      aiModel: 'openai/gpt-4o-mini',
+      aiProvider: DEFAULT_AI_PROVIDER,
+      aiModel: DEFAULT_AI_MODEL,
       hasAiKey: false,
     },
     expires: 'never',
@@ -73,6 +76,13 @@ export const exchangeRemoteTokenFn = createServerFn({ method: 'POST' })
     return data
   })
   .handler(async ({ data }) => {
+    // 与 logoutRemoteFn 同口径：非桌面部署下任何客户端都能借本服务向 SaaS 探测任意 token
+    // 并污染服务端 remote-auth 状态（审计 2026-10-25）
+    if (!isDesktopServer()) {
+      throw new Error('exchangeRemoteTokenFn 仅桌面端可用')
+    }
+    // 防把暴力面代理到上游 SaaS（无限次换 token 探测）
+    await checkAuthRateLimit('exchangeRemoteToken', 10, 15 * 60 * 1000)
     const { token } = data
 
     const res = await fetch(`${SAAS_URL}/api/auth/desktop-callback?exchange=true`, {
@@ -80,12 +90,18 @@ export const exchangeRemoteTokenFn = createServerFn({ method: 'POST' })
         Cookie: `auth.session-token=${token}`,
       },
       credentials: 'omit',
+      signal: AbortSignal.timeout(10_000),
     })
     if (!res.ok) {
       throw new Error(`SaaS 验证失败: ${res.status}`)
     }
 
-    const profile = (await res.json()) as SaaSProfileResponse
+    let profile: z.infer<typeof saasProfileSchema>
+    try {
+      profile = saasProfileSchema.parse(await res.json())
+    } catch {
+      throw new Error('SaaS 响应格式异常')
+    }
     if (!profile.user?.id) {
       throw new Error('SaaS token 无效或已过期')
     }

package/src/server/serverFns/auth/setup.ts

@@ -18,6 +18,8 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
 
+// 首启向导必需（彼时无任何账号可登录）→ 有意公开；部署完成后恒为 hasAdmin=true，
+// 仅泄露「管理员是否已初始化」一个布尔，敏感度极低（审计 2026-10-25 标注豁免）。
 export const checkAdminExistsFn = createServerFn({ method: 'GET' }).handler(async () => {
     const prisma = await getPrisma()
   const count = await prisma.user.count({

package/src/server/serverFns/billing.ts

@@ -32,10 +32,8 @@ const requireBilling = () => {
 }
 
 export const getEffectivePlanFn = createServerFn({ method: 'GET' }).handler(async () => {
-    const prisma = await getPrisma()
   const request = getRequest()
   const session = await requireAuth(request)
-  const userId = session.user!.id!
 
   const { planName, enabled, unavailable, source } = await getEntitlements(request)
   const resources = await getResourceSnapshots(request)
@@ -50,17 +48,17 @@ export const getEffectivePlanFn = createServerFn({ method: 'GET' }).handler(asyn
 })
 
 export const getSubscriptionFn = createServerFn({ method: 'GET' }).handler(async () => {
-    const prisma = await getPrisma()
   const request = getRequest()
   const session = await requireAuth(request)
-  const userId = session.user!.id!
+  const userId = session.user.id
   return requireBilling().getSubscription(userId)
 })
 
+// 公开定价目录（_public/pricing 落地页 loader）→ 有意公开，未登录可读
+// （审计 2026-10-25 标注豁免）
 export const listPublicPlansFn = createServerFn({ method: 'GET' })
   .validator(z.object({ currency: z.enum(['usd', 'cny']) }))
   .handler(async ({ data }) => {
-    const prisma = await getPrisma()
     return requireBilling().listPublicPlans(data.currency)
   })
 
@@ -72,10 +70,9 @@ export const createCheckoutSessionFn = createServerFn({ method: 'POST' })
     }),
   )
   .handler(async ({ data }) => {
-    const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
 
     const baseUrl = process.env.VITE_APP_URL ?? 'http://localhost:3000'
     return requireBilling().createCheckoutSession({
@@ -90,10 +87,9 @@ export const createCheckoutSessionFn = createServerFn({ method: 'POST' })
 
 export const createCustomerPortalSessionFn = createServerFn({ method: 'POST' }).validator(z.object({})).handler(
   async () => {
-    const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
 
     const baseUrl = process.env.VITE_APP_URL ?? 'http://localhost:3000'
     return requireBilling().createCustomerPortalSession({
@@ -104,10 +100,9 @@ export const createCustomerPortalSessionFn = createServerFn({ method: 'POST' }).
 )
 
 export const listInvoicesFn = createServerFn({ method: 'GET' }).handler(async () => {
-    const prisma = await getPrisma()
   const request = getRequest()
   const session = await requireAuth(request)
-  const userId = session.user!.id!
+  const userId = session.user.id
   return requireBilling().listInvoices(userId, 20)
 })
 
@@ -117,7 +112,7 @@ export const updatePreferredCurrencyFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     await prisma.user.update({
       where: { id: userId },
       data: { preferredCurrency: data.currency },
@@ -135,7 +130,7 @@ export const updateSeatsFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     const baseUrl = process.env.VITE_APP_URL ?? 'http://localhost:3000'
 
     const subscription = await prisma.subscription.findUnique({
@@ -166,9 +161,20 @@ export const updateSeatsFn = createServerFn({ method: 'POST' })
       )
     }
 
+    // successUrl 限本站同源，防被用作开放重定向/钓鱼跳板；非法或跨源一律回落默认
+    const baseUrlOrigin = new URL(baseUrl).origin
+    let successUrl = `${baseUrl}/settings/billing?checkout=success`
+    if (data.successUrl) {
+      try {
+        if (new URL(data.successUrl).origin === baseUrlOrigin) successUrl = data.successUrl
+      } catch {
+        // 回落默认
+      }
+    }
+
     return requireBilling().updateSeats({
       userId,
       addonSeats: data.addonSeats,
-      successUrl: data.successUrl ?? `${baseUrl}/settings/billing?checkout=success`,
+      successUrl,
     })
   })

package/src/server/serverFns/blob-upload.ts

@@ -72,8 +72,19 @@ export const uploadBlobFn = createServerFn({ method: "POST" })
       return { error: "SizeExceeded" as const }
     }
 
+    // 文件名归一化：剥离路径分隔符与控制字符，防存储层按文件名落盘时的路径拼接
+    const sanitizedFileName =
+      Array.from(data.fileName)
+        .map((ch) => (ch === "/" || ch === "\\" ? "_" : ch))
+        .filter((ch) => {
+          const code = ch.charCodeAt(0)
+          return code >= 32 && code !== 127
+        })
+        .join("")
+        .trim() || "file"
+
     const ref = await getPorts().blobStore.put(
-      data.fileName,
+      sanitizedFileName,
       Buffer.from(bytes),
       data.mimeType,
       userId,

package/src/server/serverFns/bug/__tests__/bug-access-tokens.test.ts

@@ -64,6 +64,7 @@ vi.mock("@allbluecn/database", () => {
   const prisma = {
     projectMember: { findUnique: mocks.memberFindUnique },
     projectAccessToken: {
+      count: vi.fn().mockResolvedValue(0),
       findMany: mocks.tokenFindMany,
       findFirst: mocks.tokenFindFirst,
       create: mocks.tokenCreate,

package/src/server/serverFns/bug/__tests__/bug-activities.test.ts

@@ -103,7 +103,7 @@ beforeEach(() => {
 });
 
 describe("listBugActivitiesFn", () => {
-  it("按 bugId + createdAt 倒序取页，满页时返回 nextCursor", async () => {
+  it("按 bugId + createdAt 倒序取页，满页时返回复合 nextCursor", async () => {
     // createdAt 倒序 5..0，take=5 → 取 6 条探测，截前 5 条
     const rows = Array.from({ length: 6 }, (_, i) => activityRow({}, 5 - i));
     mocks.bugActivityFindMany.mockResolvedValue(rows);
@@ -113,7 +113,7 @@ describe("listBugActivitiesFn", () => {
     expect(mocks.bugActivityFindMany).toHaveBeenCalledWith(
       expect.objectContaining({
         where: { bugId: BUG_ID },
-        orderBy: { createdAt: "desc" },
+        orderBy: [{ createdAt: "desc" }, { id: "desc" }],
         take: 6,
       }),
     );
@@ -121,7 +121,7 @@ describe("listBugActivitiesFn", () => {
     expect(res.items[0].id).toBe("a5");
     expect(res.items[0].createdAt).toBe(T(5).toISOString());
     expect(res.items[4].id).toBe("a1");
-    expect(res.nextCursor).toBe(T(1).toISOString());
+    expect(res.nextCursor).toBe(JSON.stringify({ c: T(1).toISOString(), i: "a1" }));
   });
 
   it("cursor 转 createdAt lt 条件继续翻页", async () => {
@@ -137,6 +137,33 @@ describe("listBugActivitiesFn", () => {
     );
   });
 
+  it("复合游标（同秒多条）转 (createdAt,id) 双键 OR 条件继续翻页", async () => {
+    mocks.bugActivityFindMany.mockResolvedValue([]);
+    const cursor = JSON.stringify({ c: "2026-01-01T00:00:03.000Z", i: "a9" });
+
+    await listBugActivitiesFn({ data: { bugId: BUG_ID, take: 5, cursor } });
+
+    expect(mocks.bugActivityFindMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: {
+          bugId: BUG_ID,
+          OR: [
+            { createdAt: { lt: new Date("2026-01-01T00:00:03.000Z") } },
+            { createdAt: new Date("2026-01-01T00:00:03.000Z"), id: { lt: "a9" } },
+          ],
+        },
+      }),
+    );
+  });
+
+  it("非法 cursor 拒绝且不查询", async () => {
+    mocks.bugActivityFindMany.mockResolvedValue([]);
+    await expect(
+      listBugActivitiesFn({ data: { bugId: BUG_ID, take: 5, cursor: "not-a-date" } }),
+    ).rejects.toThrow("无效的分页游标");
+    expect(mocks.bugActivityFindMany).not.toHaveBeenCalled();
+  });
+
   it("默认 take=50（取 51 条探测），无更多时 nextCursor 为 null", async () => {
     const rows = [activityRow({ id: "a1" }, 0), activityRow({ id: "a2" }, 1)];
     mocks.bugActivityFindMany.mockResolvedValue(rows);

package/src/server/serverFns/bug/__tests__/bug-collect.test.ts

@@ -146,13 +146,28 @@ interface StubFile {
   arrayBuffer: () => Promise<ArrayBuffer>;
 }
 
-const stubFile = (over: Partial<StubFile> = {}): StubFile => ({
-  name: "shot.png",
-  type: "image/png",
-  size: 1024,
-  arrayBuffer: async () => new Uint8Array([1, 2, 3]).buffer,
-  ...over,
-});
+/** 魔数复检（审计 🟡）落地后，stubFile 按 type 生成对应图片魔数字节 */
+const MAGIC_BY_TYPE: Record<string, number[]> = {
+  "image/png": [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a],
+  "image/jpeg": [0xff, 0xd8, 0xff, 0xe0],
+};
+
+const stubFile = (over: Partial<StubFile> = {}): StubFile => {
+  const base = {
+    name: "shot.png",
+    type: "image/png",
+    size: 1024,
+    ...over,
+  };
+  const magic = MAGIC_BY_TYPE[base.type] ?? [0x00, 0x01, 0x02];
+  return {
+    ...base,
+    // 显式传入 arrayBuffer（伪造字节用例）优先，否则按 type 生成魔数字节
+    arrayBuffer:
+      over.arrayBuffer ??
+      (async () => new Uint8Array([...magic, 0x0a, 0x0b, 0x0c]).buffer),
+  };
+}
 
 const stubUploadRequest = (
   files: StubFile[],
@@ -335,11 +350,17 @@ describe("submitCollectedBug", () => {
     expect(mocks.txBugEventCreate).not.toHaveBeenCalled();
   });
 
-  it("blob 属他人（userId ≠ owner）→ invalid_screenshots 不落库", async () => {
-    mocks.blobFindMany.mockResolvedValue([{ id: "blob1", userId: "someone-else" }]);
+  it("blob 属他人（userId ≠ owner）→ invalid_screenshots 不落库（where 谓词过滤后计数不符）", async () => {
+    // 归属校验已下沉到 findMany where（userId=owner + 24h 时间窗）：
+    // mock 模拟 DB 谓词过滤——非 owner blob 不出现在结果集
+    mocks.blobFindMany.mockResolvedValue([]);
     const out = await submitAnonymously(validInput({ screenshotBlobIds: ["blob1"] }));
     expect(out).toEqual({ ok: false, reason: "invalid_screenshots" });
     expect(mocks.$transaction).not.toHaveBeenCalled();
+    // 谓词三件套锁定：id 集合 + owner 归属 + 时间窗
+    const where = mocks.blobFindMany.mock.calls[0][0].where as Record<string, unknown>;
+    expect(where.userId).toBe(OWNER_ID);
+    expect(where.createdAt).toBeDefined();
   });
 
   it("blob 部分不存在 → invalid_screenshots", async () => {
@@ -367,7 +388,7 @@ describe("submitCollectedBug", () => {
   });
 });
 
-// ── submitCollectedBugFn 薄壳（ip 从 getRequest 的 x-forwarded-for 接线）──
+// ── submitCollectedBugFn 薄壳（ip 经 kernel getClientIp 可信代理口径接线）──
 describe("submitCollectedBugFn", () => {
   it("透传 validator + ip/session 接线到核心逻辑", async () => {
     const out = await submitCollectedBugFn({ data: validInput() });
@@ -454,13 +475,27 @@ describe("handleCollectUpload", () => {
     expect(batch.data).toHaveLength(2);
     expect(batch.data[0]).toMatchObject({
       mimeType: "image/jpeg",
-      size: 1024,
+      // size 落实际字节数（魔数复检后以 buffer 为准）
+      size: (batch.data[0] as { bytes: Uint8Array }).bytes.byteLength,
       userId: OWNER_ID,
     });
     expect(mocks.tokenUpdate).toHaveBeenCalled();
   });
 
-  it("IP 取 x-forwarded-for（与既有 rate-limit key 惯例一致），缺失回 unknown", async () => {
+  it("伪造成 image/png 的非图片字节（魔数不符）→ 415 不落库", async () => {
+    const res = await handleCollectUpload(
+      stubUploadRequest([
+        stubFile({
+          type: "image/png",
+          arrayBuffer: async () => new Uint8Array([0x4d, 0x5a, 0x90, 0x00]).buffer, // PE 头
+        }),
+      ]),
+    );
+    expect(res.status).toBe(415);
+    expect(mocks.blobCreateManyAndReturn).not.toHaveBeenCalled();
+  });
+
+  it("IP 取 getClientIp 口径（XFF 末段），缺失回 unknown", async () => {
     mocks.blobCreateManyAndReturn.mockResolvedValue([{ id: "blob-1" }]);
     await handleCollectUpload(
       stubUploadRequest([stubFile()], { "X-Bug-Key": VALID_KEY }),

package/src/server/serverFns/bug/__tests__/bug-comments.test.ts

@@ -51,10 +51,13 @@ const mocks = vi.hoisted(() => ({
   currentSession: vi.fn(),
   bugFindUnique: vi.fn(),
   bugCommentFindUnique: vi.fn(),
+  bugCommentFindFirst: vi.fn(),
   bugCommentFindMany: vi.fn(),
   bugCommentCreate: vi.fn(),
   bugCommentUpdate: vi.fn(),
+  bugCommentUpdateMany: vi.fn(),
   bugCommentDelete: vi.fn(),
+  bugCommentDeleteMany: vi.fn(),
   bugActivityCreate: vi.fn(),
   projectMemberFindUnique: vi.fn(),
 }));
@@ -64,13 +67,18 @@ vi.mock("@allbluecn/database", () => {
     bug: { findUnique: mocks.bugFindUnique },
     bugComment: {
       findUnique: mocks.bugCommentFindUnique,
+      findFirst: mocks.bugCommentFindFirst,
       findMany: mocks.bugCommentFindMany,
       create: mocks.bugCommentCreate,
       update: mocks.bugCommentUpdate,
+      updateMany: mocks.bugCommentUpdateMany,
       delete: mocks.bugCommentDelete,
+      deleteMany: mocks.bugCommentDeleteMany,
     },
     bugActivity: { create: mocks.bugActivityCreate },
     projectMember: { findUnique: mocks.projectMemberFindUnique },
+    // createCommentFn 的评论 + 活动双写在交互式事务内：tx 即同一组 mock
+    $transaction: (fn: (tx: unknown) => Promise<unknown>) => fn(prisma),
   };
   return { prisma, Prisma: {} };
 });
@@ -120,6 +128,8 @@ beforeEach(() => {
   mocks.projectMemberFindUnique.mockResolvedValue({ status: "active" });
   mocks.bugCommentCreate.mockResolvedValue(commentRow());
   mocks.bugActivityCreate.mockResolvedValue({});
+  mocks.bugCommentUpdateMany.mockResolvedValue({ count: 1 });
+  mocks.bugCommentDeleteMany.mockResolvedValue({ count: 1 });
 });
 
 describe("listCommentsFn", () => {
@@ -253,13 +263,26 @@ describe("createCommentFn", () => {
     expect(res.user.avatarConfig).toBeNull();
   });
 
-  it("子评论带上 parentId 写入", async () => {
+  it("子评论带上 parentId 写入（父评论存在且同 bug 前置校验）", async () => {
+    mocks.bugCommentFindFirst.mockResolvedValue({ id: "c1" });
     await createCommentFn({ data: { bugId: BUG_ID, content: "回复", parentId: "c1" } });
+    expect(mocks.bugCommentFindFirst).toHaveBeenCalledWith({
+      where: { id: "c1", bugId: BUG_ID },
+      select: { id: true },
+    });
     expect(mocks.bugCommentCreate).toHaveBeenCalledWith(
       expect.objectContaining({ data: expect.objectContaining({ parentId: "c1" }) }),
     );
   });
 
+  it("parentId 指向不存在/跨 bug 评论时拒绝", async () => {
+    mocks.bugCommentFindFirst.mockResolvedValue(null);
+    await expect(
+      createCommentFn({ data: { bugId: BUG_ID, content: "回复", parentId: "ghost" } }),
+    ).rejects.toThrow("父评论不存在或不属于当前 BUG");
+    expect(mocks.bugCommentCreate).not.toHaveBeenCalled();
+  });
+
   it("suspended 成员视同无权且不创建", async () => {
     mocks.projectMemberFindUnique.mockResolvedValue({ status: "suspended" });
     await expect(
@@ -284,9 +307,10 @@ describe("createCommentFn", () => {
 });
 
 describe("updateCommentFn", () => {
-  it("本人评论可编辑并返回新内容", async () => {
-    mocks.bugCommentFindUnique.mockResolvedValue({ userId: USER, bugId: BUG_ID });
-    mocks.bugCommentUpdate.mockResolvedValue({ id: "c1", content: "新内容", updatedAt: T2 });
+  it("本人评论可编辑（条件写 + 回读）并返回新内容", async () => {
+    mocks.bugCommentFindUnique
+      .mockResolvedValueOnce({ userId: USER, bugId: BUG_ID })
+      .mockResolvedValueOnce({ id: "c1", content: "新内容", updatedAt: T2 });
 
     const res = await updateCommentFn({ data: { commentId: "c1", content: "新内容" } });
 
@@ -294,10 +318,9 @@ describe("updateCommentFn", () => {
       where: { id: "c1" },
       select: { userId: true, bugId: true },
     });
-    expect(mocks.bugCommentUpdate).toHaveBeenCalledWith({
-      where: { id: "c1" },
+    expect(mocks.bugCommentUpdateMany).toHaveBeenCalledWith({
+      where: { id: "c1", userId: USER },
       data: { content: "新内容" },
-      select: { id: true, content: true, updatedAt: true },
     });
     expect(res).toEqual({ id: "c1", content: "新内容", updatedAt: T2.toISOString() });
   });
@@ -308,7 +331,7 @@ describe("updateCommentFn", () => {
     await expect(
       updateCommentFn({ data: { commentId: "c1", content: "编辑" } }),
     ).rejects.toThrow("无权限操作该项目的 BUG");
-    expect(mocks.bugCommentUpdate).not.toHaveBeenCalled();
+    expect(mocks.bugCommentUpdateMany).not.toHaveBeenCalled();
   });
 
   it("他人评论被拒且不执行更新", async () => {
@@ -316,7 +339,16 @@ describe("updateCommentFn", () => {
     await expect(
       updateCommentFn({ data: { commentId: "c1", content: "篡改" } }),
     ).rejects.toThrow("无权编辑他人评论");
-    expect(mocks.bugCommentUpdate).not.toHaveBeenCalled();
+    expect(mocks.bugCommentUpdateMany).not.toHaveBeenCalled();
+  });
+
+  it("条件写零行命中（并发被改属主/删除）时报错", async () => {
+    // updateMany 抛错路径走不到回读，只排第一个 Once 免污染后续用例
+    mocks.bugCommentFindUnique.mockResolvedValueOnce({ userId: USER, bugId: BUG_ID });
+    mocks.bugCommentUpdateMany.mockResolvedValue({ count: 0 });
+    await expect(
+      updateCommentFn({ data: { commentId: "c1", content: "x" } }),
+    ).rejects.toThrow("评论不存在或无权编辑");
   });
 
   it("评论不存在时报错且不执行更新", async () => {
@@ -324,14 +356,13 @@ describe("updateCommentFn", () => {
     await expect(
       updateCommentFn({ data: { commentId: "missing", content: "x" } }),
     ).rejects.toThrow("评论不存在");
-    expect(mocks.bugCommentUpdate).not.toHaveBeenCalled();
+    expect(mocks.bugCommentUpdateMany).not.toHaveBeenCalled();
   });
 });
 
 describe("deleteCommentFn", () => {
-  it("项目成员可删除（有回复时由 FK 级联清树）", async () => {
+  it("项目成员可删除（条件删除 + 计数判定，有回复时由 FK 级联清树）", async () => {
     mocks.bugCommentFindUnique.mockResolvedValue({ bugId: BUG_ID });
-    mocks.bugCommentDelete.mockResolvedValue({ id: "c1" });
 
     await expect(deleteCommentFn({ data: { commentId: "c1" } })).resolves.toEqual({
       success: true,
@@ -340,7 +371,7 @@ describe("deleteCommentFn", () => {
       where: { id: "c1" },
       select: { bugId: true },
     });
-    expect(mocks.bugCommentDelete).toHaveBeenCalledWith({ where: { id: "c1" } });
+    expect(mocks.bugCommentDeleteMany).toHaveBeenCalledWith({ where: { id: "c1" } });
   });
 
   it("项目非成员拒绝且不删除", async () => {
@@ -349,7 +380,7 @@ describe("deleteCommentFn", () => {
     await expect(deleteCommentFn({ data: { commentId: "c1" } })).rejects.toThrow(
       "无权限操作该项目的 BUG",
     );
-    expect(mocks.bugCommentDelete).not.toHaveBeenCalled();
+    expect(mocks.bugCommentDeleteMany).not.toHaveBeenCalled();
   });
 
   it("评论不存在时报错且不删除", async () => {
@@ -357,13 +388,13 @@ describe("deleteCommentFn", () => {
     await expect(deleteCommentFn({ data: { commentId: "missing" } })).rejects.toThrow(
       "评论不存在",
     );
-    expect(mocks.bugCommentDelete).not.toHaveBeenCalled();
+    expect(mocks.bugCommentDeleteMany).not.toHaveBeenCalled();
   });
 
   it("未登录拒绝且不查询评论归属", async () => {
     mocks.currentSession.mockRejectedValue(new Error("UNAUTHORIZED"));
     await expect(deleteCommentFn({ data: { commentId: "c1" } })).rejects.toThrow("UNAUTHORIZED");
     expect(mocks.bugCommentFindUnique).not.toHaveBeenCalled();
-    expect(mocks.bugCommentDelete).not.toHaveBeenCalled();
+    expect(mocks.bugCommentDeleteMany).not.toHaveBeenCalled();
   });
 });

package/src/server/serverFns/bug/__tests__/bug-groups.test.ts

@@ -106,10 +106,10 @@ import {
 import {
   BUG_DISPLAY_OPTIONS_VIEW_NAME,
   DEFAULT_BUG_DISPLAY_OPTIONS,
-} from "@/components/bug/display/types";
+} from "@/shared/bug/display-types";
 import { BUG_STATES } from "@/shared/bug/constants";
 import { BUG_LIST_SELECT } from "@/components/bug/types";
-import type { BugDisplayOptions } from "@/components/bug/display/types";
+import type { BugDisplayOptions } from "@/shared/bug/display-types";
 
 const DATE = new Date("2026-01-01T00:00:00Z");
 

package/src/server/serverFns/bug/__tests__/bug-list-query.test.ts

@@ -127,6 +127,16 @@ describe("buildListWhere filters 翻译", () => {
     expect(where.AND).toEqual([{ OR: [{ assigneeId: null }, { assigneeId: { in: ["u2"] } }] }]);
   });
 
+  it("assigneeId is_not 混合 __none__ 与具体用户 → 非空且 notIn（未指派不得重新命中）", () => {
+    const where = buildListWhere({
+      userId: "u1",
+      filters: JSON.stringify([{ property: "assigneeId", operator: "is_not", value: "__none__,u2" }]),
+    });
+    expect(where.AND).toEqual([
+      { AND: [{ assigneeId: { not: null } }, { assigneeId: { notIn: ["u2"] } }] },
+    ]);
+  });
+
   it("assigneeId is_empty / is_not_empty → null / not null", () => {
     const empty = buildListWhere({
       userId: "u1",