@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/bug/__tests__/bug-reactions.test.ts

@@ -57,6 +57,7 @@ const mocks = vi.hoisted(() => ({
   bugCommentReactionCreate: vi.fn(),
   bugCommentReactionUpsert: vi.fn(),
   bugCommentReactionDelete: vi.fn(),
+  bugCommentReactionDeleteMany: vi.fn(),
   projectMemberFindUnique: vi.fn(),
 }));
 
@@ -69,6 +70,7 @@ vi.mock("@allbluecn/database", () => {
       create: mocks.bugCommentReactionCreate,
       upsert: mocks.bugCommentReactionUpsert,
       delete: mocks.bugCommentReactionDelete,
+      deleteMany: mocks.bugCommentReactionDeleteMany,
     },
     projectMember: { findUnique: mocks.projectMemberFindUnique },
   };
@@ -107,6 +109,7 @@ beforeEach(() => {
   mocks.bugCommentReactionCreate.mockResolvedValue({});
   mocks.bugCommentReactionUpsert.mockResolvedValue({});
   mocks.bugCommentReactionDelete.mockResolvedValue({});
+  mocks.bugCommentReactionDeleteMany.mockResolvedValue({ count: 1 });
 });
 
 describe("listBugCommentReactionsFn", () => {
@@ -250,7 +253,7 @@ describe("addBugCommentReactionFn", () => {
 
 describe("toggleBugCommentReactionFn", () => {
   it("同 emoji 二次 toggle 删除（幂等），聚合随之消长", async () => {
-    // 第一次：无既有表态 → create，聚合为当前用户 1 票
+    // 第一次：无既有表态 → upsert（并发双击撞唯一键时 update:{} 吞为幂等），聚合为当前用户 1 票
     mocks.bugCommentReactionFindMany.mockResolvedValueOnce([reactionRow({ userId: USER })]);
     const first = await toggleBugCommentReactionFn({
       data: { commentId: COMMENT_ID, emoji: EMOJI },
@@ -261,12 +264,16 @@ describe("toggleBugCommentReactionFn", () => {
         commentId_userId_emoji: { commentId: COMMENT_ID, userId: USER, emoji: EMOJI },
       },
     });
-    expect(mocks.bugCommentReactionCreate).toHaveBeenCalledWith({
-      data: { commentId: COMMENT_ID, userId: USER, emoji: EMOJI },
+    expect(mocks.bugCommentReactionUpsert).toHaveBeenCalledWith({
+      where: {
+        commentId_userId_emoji: { commentId: COMMENT_ID, userId: USER, emoji: EMOJI },
+      },
+      update: {},
+      create: { commentId: COMMENT_ID, userId: USER, emoji: EMOJI },
     });
     expect(first).toEqual([{ emoji: EMOJI, count: 1, userIds: [USER], reacted: true }]);
 
-    // 第二次：已有本人表态 → 按 id 删除，他人表态保留
+    // 第二次：已有本人表态 → 按三元组 deleteMany（并发双删空转不抛 P2025），他人表态保留
     mocks.bugCommentReactionFindUnique.mockResolvedValueOnce({
       id: "r1",
       commentId: COMMENT_ID,
@@ -278,12 +285,14 @@ describe("toggleBugCommentReactionFn", () => {
       data: { commentId: COMMENT_ID, emoji: EMOJI },
     });
 
-    expect(mocks.bugCommentReactionDelete).toHaveBeenCalledWith({ where: { id: "r1" } });
+    expect(mocks.bugCommentReactionDeleteMany).toHaveBeenCalledWith({
+      where: { commentId: COMMENT_ID, userId: USER, emoji: EMOJI },
+    });
     expect(second).toEqual([{ emoji: EMOJI, count: 1, userIds: [OTHER], reacted: false }]);
   });
 
   it("toggle 不影响他人既有表态的聚合", async () => {
-    // 本人 toggle：既有的是他人表态 → 本人走 create 路径
+    // 本人 toggle：既有的是他人表态 → 本人走 upsert 添加路径
     mocks.bugCommentReactionFindUnique.mockResolvedValueOnce(null);
     mocks.bugCommentReactionFindMany.mockResolvedValueOnce([
       reactionRow({ userId: OTHER }),
@@ -294,8 +303,8 @@ describe("toggleBugCommentReactionFn", () => {
       data: { commentId: COMMENT_ID, emoji: EMOJI },
     });
 
-    expect(mocks.bugCommentReactionCreate).toHaveBeenCalledTimes(1);
-    expect(mocks.bugCommentReactionDelete).not.toHaveBeenCalled();
+    expect(mocks.bugCommentReactionUpsert).toHaveBeenCalledTimes(1);
+    expect(mocks.bugCommentReactionDeleteMany).not.toHaveBeenCalled();
     expect(res).toEqual([{ emoji: EMOJI, count: 2, userIds: [OTHER, USER], reacted: true }]);
   });
 
@@ -305,7 +314,8 @@ describe("toggleBugCommentReactionFn", () => {
       toggleBugCommentReactionFn({ data: { commentId: "missing", emoji: EMOJI } }),
     ).rejects.toThrow("评论不存在");
     expect(mocks.bugCommentReactionFindUnique).not.toHaveBeenCalled();
-    expect(mocks.bugCommentReactionCreate).not.toHaveBeenCalled();
+    expect(mocks.bugCommentReactionUpsert).not.toHaveBeenCalled();
+    expect(mocks.bugCommentReactionDeleteMany).not.toHaveBeenCalled();
   });
 
   it("非项目成员拒绝且不写入（403 语义）", async () => {
@@ -314,8 +324,8 @@ describe("toggleBugCommentReactionFn", () => {
       toggleBugCommentReactionFn({ data: { commentId: COMMENT_ID, emoji: EMOJI } }),
     ).rejects.toThrow("无权限操作该项目的 BUG");
     expect(mocks.bugCommentReactionFindUnique).not.toHaveBeenCalled();
-    expect(mocks.bugCommentReactionCreate).not.toHaveBeenCalled();
-    expect(mocks.bugCommentReactionDelete).not.toHaveBeenCalled();
+    expect(mocks.bugCommentReactionUpsert).not.toHaveBeenCalled();
+    expect(mocks.bugCommentReactionDeleteMany).not.toHaveBeenCalled();
   });
 
   it("空 emoji 被 validator 拒绝（不落库）", async () => {

package/src/server/serverFns/bug/__tests__/bug-webhooks.test.ts

@@ -82,6 +82,7 @@ import {
   toggleBugWebhookFn,
 } from "../bug-webhooks";
 import { FetchGuardError } from "@/server/fetch-guard";
+import { decryptApiKey } from "@/server/lib/api-key-cipher"
 
 const DATE = new Date("2026-01-01T00:00:00Z");
 
@@ -107,17 +108,19 @@ describe("createBugWebhookFn", () => {
       url: "https://hooks.example.com/a",
       events: ["bug.created", "fix.completed"],
     });
-    // 落库含 secret + enabled:true，events 为订阅数组
-    expect(mocks.webhookCreate).toHaveBeenCalledWith({
-      data: expect.objectContaining({
-        projectId: "p1",
-        url: "https://hooks.example.com/a",
-        secret: out.secret,
-        events: ["bug.created", "fix.completed"],
-        enabled: true,
-      }),
-      select: expect.anything(),
+    // 落库为 AES-256-GCM 密文（静态加密），明文只随本次响应回显一次
+    const created = mocks.webhookCreate.mock.calls[0][0] as {
+      data: Record<string, unknown>;
+      select: unknown;
+    };
+    expect(created.data).toMatchObject({
+      projectId: "p1",
+      url: "https://hooks.example.com/a",
+      events: ["bug.created", "fix.completed"],
+      enabled: true,
     });
+    expect(created.data.secret).toMatch(/^enc:v1:/);
+    expect(decryptApiKey(created.data.secret as string)).toBe(out.secret);
   });
 
   it("两次创建产生不同 secret（CSPRNG）", async () => {

package/src/server/serverFns/bug/bug-access-tokens.ts

@@ -50,7 +50,7 @@ export const listBugTokensFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     const rows = await prisma.projectAccessToken.findMany({
@@ -91,9 +91,17 @@ export const createBugTokenFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await assertProjectMembership(data.projectId, userId);
 
+    // 单项目凭证数量上限：防成员无限创建凭证行（表膨胀 + 管理面噪音）
+    const tokenCount = await prisma.projectAccessToken.count({
+      where: { projectId: data.projectId, scope: "bug.report" },
+    });
+    if (tokenCount >= 100) {
+      throw new Error("凭证数量已达上限（100），请先吊销不再使用的凭证");
+    }
+
     const { plaintext, tokenHash, tokenPrefix } = generateProjectToken();
     const row = await prisma.projectAccessToken.create({
       data: {
@@ -127,7 +135,7 @@ export const revokeBugTokenFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     const revokedAt = new Date();
@@ -165,7 +173,7 @@ export const getBugProjectSettingsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     const row = await prisma.bugProjectSettings.findUnique({
@@ -197,7 +205,7 @@ export const updateBugProjectSettingsFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     // update 只写提供的字段（不重置其余）；create 合并默认值（未提供字段回默认）

package/src/server/serverFns/bug/bug-activities.ts

@@ -40,26 +40,56 @@ function castActivityUser(u: {
 const listActivitiesSchema = z.object({
   bugId: z.string(),
   take: z.number().int().min(1).max(200).default(50),
-  cursor: z.string().optional(),
+  cursor: z.string().max(256).optional(),
 });
 
+/**
+ * 游标解析：新格式为 JSON `{"c":<ISO>,"i":<id>}` 复合游标（同秒多条不丢不重）；
+ * 旧格式（纯 ISO 串）按 createdAt 单键兼容解析；非法串直接拒绝而非 Prisma 500。
+ */
+function parseActivityCursor(cursor: string): { createdAt: Date; id?: string } {
+  if (cursor.startsWith("{")) {
+    try {
+      const parsed = JSON.parse(cursor) as { c?: string; i?: string };
+      const d = new Date(parsed.c ?? "");
+      if (Number.isNaN(d.getTime())) throw new Error("bad cursor");
+      return { createdAt: d, id: parsed.i };
+    } catch {
+      throw new Error("无效的分页游标");
+    }
+  }
+  const d = new Date(cursor);
+  if (Number.isNaN(d.getTime())) throw new Error("无效的分页游标");
+  return { createdAt: d };
+}
+
 export const listBugActivitiesFn = createServerFn({ method: "GET" })
   .validator(listActivitiesSchema)
   .handler(async ({ data }) => {
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 
     // cursor 分页走 (bugId, createdAt) 复合索引；take+1 探测 hasMore
+    const cursor = data.cursor ? parseActivityCursor(data.cursor) : null;
     const activities = await prisma.bugActivity.findMany({
       where: {
         bugId: data.bugId,
-        ...(data.cursor ? { createdAt: { lt: new Date(data.cursor) } } : {}),
+        ...(cursor
+          ? cursor.id
+            ? {
+                OR: [
+                  { createdAt: { lt: cursor.createdAt } },
+                  { createdAt: cursor.createdAt, id: { lt: cursor.id } },
+                ],
+              }
+            : { createdAt: { lt: cursor.createdAt } }
+          : {}),
       },
-      orderBy: { createdAt: "desc" },
+      orderBy: [{ createdAt: "desc" }, { id: "desc" }],
       take: data.take + 1,
       select: {
         id: true,
@@ -77,7 +107,8 @@ export const listBugActivitiesFn = createServerFn({ method: "GET" })
 
     const hasMore = activities.length > data.take;
     const items = hasMore ? activities.slice(0, data.take) : activities;
-    const nextCursor = hasMore ? items[items.length - 1].createdAt.toISOString() : null;
+    const last = items[items.length - 1];
+    const nextCursor = hasMore && last ? JSON.stringify({ c: last.createdAt.toISOString(), i: last.id }) : null;
 
     const mapped: BugActivityItem[] = items.map((a) => ({
       id: a.id,

package/src/server/serverFns/bug/bug-collect-tokens.ts

@@ -68,7 +68,7 @@ export const listCollectTokensFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     const rows = await prisma.projectAccessToken.findMany({
@@ -109,7 +109,7 @@ export const createCollectTokenFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     const { plaintext, tokenHash, tokenPrefix } = generateProjectToken();
@@ -145,7 +145,7 @@ export const revokeCollectTokenFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     const revokedAt = new Date();
@@ -201,7 +201,7 @@ export const updateCollectConfigFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     const existing = await prisma.projectAccessToken.findFirst({

package/src/server/serverFns/bug/bug-collect.ts

@@ -26,6 +26,7 @@ import { getCurrentSession } from "@/lib/session";
 import { BUG_SEVERITIES, type BugSeverity } from "@/shared/bug/constants";
 import {
   getCollectPage,
+  rateLimitIpOf,
   submitCollectedBug,
 } from "@/server/bug-collect/collect-handler";
 
@@ -54,8 +55,9 @@ export const submitCollectedBugFn = createServerFn({ method: "POST" })
   .validator(submitSchema)
   .handler(async ({ data }) => {
     const request = getRequest();
-    // IP 提取与既有 rate-limit key 惯例一致（x-forwarded-for，缺失回 unknown）
-    const ip = request.headers.get("x-forwarded-for") ?? "unknown";
+    // IP 提取走 kernel getClientIp 可信代理口径（审计修复：原始 XFF 整串可
+    // 伪造，逐请求换值即得全新限流桶）
+    const ip = rateLimitIpOf(request);
     const session = await getCurrentSession(request);
     return submitCollectedBug({ ip, session, input: data });
   });

package/src/server/serverFns/bug/bug-comments.ts

@@ -44,7 +44,7 @@ export const listCommentsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 
@@ -102,36 +102,50 @@ export const createCommentFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 
-    const comment = await prisma.bugComment.create({
-      data: {
-        bugId: data.bugId,
-        userId,
-        parentId: data.parentId ?? null,
-        content: data.content,
-      },
-      select: {
-        id: true,
-        content: true,
-        parentId: true,
-        createdAt: true,
-        updatedAt: true,
-        user: { select: BUG_USER_BRIEF_SELECT },
-      },
-    });
+    // parentId 存在性 + 同 bug 归属校验，防跨 bug 回复/孤儿评论入库
+    if (data.parentId) {
+      const parent = await prisma.bugComment.findFirst({
+        where: { id: data.parentId, bugId: data.bugId },
+        select: { id: true },
+      });
+      if (!parent) throw new Error("父评论不存在或不属于当前 BUG");
+    }
 
-    // 手动评论固定 user 侧身份（SDK/agent 评论不经此路径）
-    await prisma.bugActivity.create({
-      data: {
-        bugId: data.bugId,
-        userId,
-        action: "commented",
-        newValue: data.content.slice(0, 50),
-        actorType: "user",
-      },
+    // 评论 + 活动流水双写包事务，防「评论在而流水缺失」
+    const comment = await prisma.$transaction(async (tx) => {
+      const created = await tx.bugComment.create({
+        data: {
+          bugId: data.bugId,
+          userId,
+          parentId: data.parentId ?? null,
+          content: data.content,
+        },
+        select: {
+          id: true,
+          content: true,
+          parentId: true,
+          createdAt: true,
+          updatedAt: true,
+          user: { select: BUG_USER_BRIEF_SELECT },
+        },
+      });
+
+      // 手动评论固定 user 侧身份（SDK/agent 评论不经此路径）
+      await tx.bugActivity.create({
+        data: {
+          bugId: data.bugId,
+          userId,
+          action: "commented",
+          newValue: data.content.slice(0, 50),
+          actorType: "user",
+        },
+      });
+
+      return created;
     });
 
     return {
@@ -155,7 +169,7 @@ export const updateCommentFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const existing = await prisma.bugComment.findUnique({
       where: { id: data.commentId },
@@ -166,11 +180,18 @@ export const updateCommentFn = createServerFn({ method: "POST" })
     // R12 对称性收口：suspended/移除成员即使曾是自己写的评论也不可再编辑（与 create/delete 同口径）
     await assertBugProjectMember(existing.bugId, userId);
 
-    const updated = await prisma.bugComment.update({
-      where: { id: data.commentId },
+    // DB-03：条件写合并属主谓词，消除「校验后被并发改属主/删评论」的 TOCTOU 窗口
+    const claimed = await prisma.bugComment.updateMany({
+      where: { id: data.commentId, userId },
       data: { content: data.content },
+    });
+    if (claimed.count === 0) throw new Error("评论不存在或无权编辑");
+
+    const updated = await prisma.bugComment.findUnique({
+      where: { id: data.commentId },
       select: { id: true, content: true, updatedAt: true },
     });
+    if (!updated) throw new Error("评论不存在");
 
     return {
       id: updated.id,
@@ -185,7 +206,7 @@ export const deleteCommentFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const existing = await prisma.bugComment.findUnique({
       where: { id: data.commentId },
@@ -196,9 +217,11 @@ export const deleteCommentFn = createServerFn({ method: "POST" })
     // 删除口径与任务 3 一致：bug 所属项目有效成员；有回复时由 FK onDelete: Cascade 级联清树
     await assertBugProjectMember(existing.bugId, userId);
 
-    await prisma.bugComment.delete({
+    // 条件删除 + 计数判定，防并发已删时 P2025
+    const deleted = await prisma.bugComment.deleteMany({
       where: { id: data.commentId },
     });
+    if (deleted.count === 0) throw new Error("评论不存在");
 
     return { success: true };
   });

package/src/server/serverFns/bug/bug-crud/detail.ts

@@ -33,7 +33,7 @@ export const getBugDetailFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 
@@ -62,7 +62,7 @@ export const getBugNeighborsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // 成员校验 + 圈定 projectId（任一方向越权均拒绝）
     const projectId = await assertBugProjectMember(data.bugId, userId);
@@ -96,7 +96,7 @@ export const listBugEventsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 

package/src/server/serverFns/bug/bug-crud.ts

@@ -40,6 +40,7 @@ import { normalizeCollabSteps } from "@allbluecn/collab-core/steps";
 import { withCollabGuard } from "@/server/collab/write-guard";
 import { withSequenceNumberRetry } from "@/server/lib/sequence-number-retry";
 import { touchCollabSnapshot } from "@/server/collab/touch-snapshot";
+import { assertProjectMembership as assertProjectMembershipShared } from "@/server/lib/project-membership";
 
 // 白名单校验模式（与 story 同构）：DB 中 state/severity/source 为 String，写入侧用 z.enum 收敛
 const BUG_STATE_VALUES = BUG_STATES.map((s) => s.value) as [BugState, ...BugState[]];
@@ -82,16 +83,9 @@ async function assertBugsInMemberProjects(bugIds: string[], userId: string) {
 // 按 projectId 直判变体（R8）：createBugFn 显式传 projectId 与 updateBugFn
 // （事务内已有 existing.projectId，免二次反查）使用；成员谓词与
 // assertBugsInMemberProjects/deleteBugFn 一致（有效成员关系，suspended 视同无权）
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的 BUG");
-  }
-}
+/** 项目有效成员校验（共享口径见 server/lib/project-membership：suspended 视同无权限） */
+const assertProjectMembership = (projectId: string, userId: string) =>
+  assertProjectMembershipShared(projectId, userId, "无权限操作该项目的 BUG");
 
 function toBugActivityItem(a: {
   id: string;
@@ -141,7 +135,7 @@ export const listBugsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // projectId === "__archived__" 为归档视图特殊值，直达 buildListWhere（跨项目成员圈定）；
     // 其余走 scope 解析：未传 = 全部可访问项目聚合，无效/非成员 → 静默回退独立项目，防越权
@@ -216,7 +210,7 @@ export const createBugFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     let projectId = data.projectId;
     if (projectId) {
@@ -352,6 +346,12 @@ export const createBugFn = createServerFn({ method: "POST" })
     );
   });
 
+// 日期串必须可被 Date 解析，防 Invalid Date 直入 Prisma 抛 500
+const optionalDateString = z
+  .string()
+  .refine((v) => !Number.isNaN(new Date(v).getTime()), "日期格式无效")
+  .optional();
+
 const updateSchema = z.object({
   bugId: z.string(),
   title: z.string().min(1).max(200).optional(),
@@ -364,8 +364,8 @@ const updateSchema = z.object({
   url: z.string().max(2000).nullable().optional(),
   repoHints: z.string().max(2000).nullable().optional(),
   reproduceSteps: reproduceStepsSchema.optional(),
-  firstOccurAt: z.string().optional(),
-  lastOccurAt: z.string().optional(),
+  firstOccurAt: optionalDateString,
+  lastOccurAt: optionalDateString,
   isAI: z.boolean().default(false),
 });
 
@@ -429,7 +429,7 @@ export const updateBugFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // ── Yjs 多人协作 §5.3 写入门卫（任务 22；T21 教训：提至 $transaction
     // 之前——门卫转发含网络 I/O（TTL 内重试最坏 ≈4s），事务内等待会击穿
@@ -658,7 +658,7 @@ export const deleteBugFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const bug = await prisma.bug.findUnique({
       where: { id: data.bugId },
@@ -666,14 +666,8 @@ export const deleteBugFn = createServerFn({ method: "POST" })
     });
     if (!bug) throw new Error("BUG 不存在");
 
-    // 权限校验：项目成员才可删（suspended 视同无权限）
-    const membership = await prisma.projectMember.findUnique({
-      where: { projectId_userId: { projectId: bug.projectId, userId } },
-      select: { status: true },
-    });
-    if (!membership || membership.status === "suspended") {
-      throw new Error("无权限删除该 BUG");
-    }
+    // 权限校验：项目成员才可删（suspended 视同无权限）——复用统一成员守卫
+    await assertProjectMembershipShared(bug.projectId, userId, "无权限删除该 BUG");
 
     // 删除实体 + 协同快照同事务清理（Yjs 多人协作 §5.2 删除路径，story/
     // knowledge 删除同构）：实体删后快照行必删，防 collab 服务后续装载幽灵
@@ -696,7 +690,7 @@ export const archiveBugFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // R7：与 bulk 归档同口径的项目成员校验（单条归档同属批量写权限语义）
     await assertBugsInMemberProjects([data.bugId], userId);
@@ -738,7 +732,7 @@ export const unarchiveBugFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugsInMemberProjects([data.bugId], userId);
 
@@ -780,7 +774,7 @@ export const bulkArchiveBugsFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugsInMemberProjects(data.bugIds, userId);
 
@@ -822,7 +816,7 @@ export const bulkDeleteBugsFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugsInMemberProjects(data.bugIds, userId);
 
@@ -857,7 +851,7 @@ export const bulkUpdateBugsFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugsInMemberProjects(data.bugIds, userId);
 
@@ -881,6 +875,14 @@ export const bulkUpdateBugsFn = createServerFn({ method: "POST" })
       },
     });
 
+    // 负责人团队成员校验（审计 2026-10-25：与 create/update 口径一致，批量不得绕过；
+    // 目标 bugs 可能跨项目，按涉及项目逐个校验）
+    if (data.patch.assigneeId !== undefined) {
+      for (const projectId of [...new Set(rows.map((row) => row.projectId))]) {
+        await validateBugAssignee(projectId, data.patch.assigneeId);
+      }
+    }
+
     // per-bug 门卫：仅对「相对现值有变化」的 bug 转发（无变化零写零转发零
     // 查询）；变更面即门卫 fields 面（updateBugFn 同口径，键值与客户端 Y 写
     // 端同形）。C1 属主预检：批量入口已 assertBugsInMemberProjects 圈定，