@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/bug/bug-display-options.ts

@@ -26,6 +26,7 @@ import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { requireFeature } from "@/server/entitlements";
 import { isProEdition } from "@/server/pro-services";
+import { toJsonInput } from "@/server/lib/prisma-json";
 import {
   BUG_DISPLAY_OPTIONS_VIEW_NAME,
   BUG_GROUP_KEYS,
@@ -40,12 +41,7 @@ import {
   type BugOrderKey,
   type BugOrderDirection,
   type BugPageSize,
-} from "@/components/bug/display/types";
-import type { Prisma } from "@allbluecn/database";
-
-function toJson<T>(value: T): Prisma.InputJsonValue {
-  return value as unknown as Prisma.InputJsonValue;
-}
+} from "@/shared/bug/display-types";
 
 /** 解析存储的 JSON 偏好，非法/缺失字段逐项回退默认值（照 story parseStoredOptions） */
 function parseStoredOptions(raw: unknown): BugDisplayOptions {
@@ -120,7 +116,7 @@ export const getBugDisplayOptionsFn = createServerFn({ method: "GET" }).handler(
   const prisma = await getPrisma();
   const request = getRequest();
   const session = await requireAuth(request);
-  const userId = session.user!.id!;
+  const userId = session.user.id;
 
   const row = await prisma.bugFilterView.findFirst({
     where: { userId, name: BUG_DISPLAY_OPTIONS_VIEW_NAME },
@@ -139,7 +135,7 @@ export const updateBugDisplayOptionsFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // 服务端强制校验：pageSize > 200（500/1000）为 Pro 专属，前端锁定只是 UX
     const options: BugDisplayOptions = {
@@ -156,15 +152,15 @@ export const updateBugDisplayOptionsFn = createServerFn({ method: "POST" })
     if (existing) {
       await prisma.bugFilterView.update({
         where: { id: existing.id },
-        data: { displayOptions: toJson(options) },
+        data: { displayOptions: toJsonInput(options) },
       });
     } else {
       await prisma.bugFilterView.create({
         data: {
           userId,
           name: BUG_DISPLAY_OPTIONS_VIEW_NAME,
-          filters: toJson([]),
-          displayOptions: toJson(options),
+          filters: toJsonInput([]),
+          displayOptions: toJsonInput(options),
         },
       });
     }

package/src/server/serverFns/bug/bug-export.ts

@@ -33,6 +33,7 @@ import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import type { Prisma } from "@allbluecn/database";
 import { requireAuth } from "@/server/auth-helpers";
+import { checkRateLimit } from "@/server/middlewares/rate-limit-server-fn";
 import { resolveStoryScopeProjectIds } from "@/server/builtin-project";
 import { buildListWhere } from "./bug-list-query";
 import { CSV_EXPORT_MAX_ROWS, toCsv, type CsvCell } from "@/server/csv";
@@ -64,6 +65,9 @@ const EXPORT_HEADERS: Record<"zh" | "en", string[]> = {
 /** offset 聚合批大小 */
 const BATCH_SIZE = 1000;
 
+/** 导出为昂贵读操作（2 万行封顶的多次翻页聚合），per-user 频控防刷 */
+const EXPORT_RATE_LIMIT = { max: 10, windowMs: 60_000 };
+
 /** 导出列 = 列表显示属性（user brief 仅取 username；labels 展平取 name） */
 const BUG_EXPORT_SELECT = {
   identifier: true,
@@ -85,7 +89,12 @@ export const exportBugsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
+
+    const rl = checkRateLimit(`bug-export:${userId}`, EXPORT_RATE_LIMIT);
+    if (!rl.allowed) {
+      throw new Error("导出请求过于频繁，请稍后再试");
+    }
 
     const isArchivedView = data.projectId === "__archived__";
     const projectIds = isArchivedView

package/src/server/serverFns/bug/bug-fix.ts

@@ -131,7 +131,7 @@ export const requestBugFixFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const projectId = await assertBugProjectMember(data.bugId, userId);
 
@@ -199,7 +199,7 @@ export const cancelBugFixFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 
@@ -235,7 +235,7 @@ export const listFixRunsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 

package/src/server/serverFns/bug/bug-group-query.ts

@@ -24,7 +24,7 @@ import {
   BUG_GROUP_DISPLAY_ORDER,
   type BugGroupKey,
   type BugOrderKey,
-} from "@/components/bug/display/types";
+} from "@/shared/bug/display-types";
 import { BUG_LIST_SELECT, type BugListRow } from "@/components/bug/types";
 
 /** prisma.groupBy 的 by 字段映射（assignee/createdBy 用外键列分组计数） */

package/src/server/serverFns/bug/bug-groups.ts

@@ -30,7 +30,7 @@ import {
   BUG_ORDER_KEYS,
   BUG_ORDER_DIRECTIONS,
   type BugGroupKey,
-} from "@/components/bug/display/types";
+} from "@/shared/bug/display-types";
 import { BUG_LIST_SELECT, castBugUsers } from "@/components/bug/types";
 import { buildListWhere } from "./bug-list-query";
 import {
@@ -98,7 +98,7 @@ export const listBugsInGroupFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const scope = await resolveReadScope(data.projectId, userId);
     const base = buildListWhere({
@@ -155,7 +155,7 @@ export const listAllGroupsItemsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const scope = await resolveReadScope(data.projectId, userId);
     const base = buildListWhere({
@@ -207,7 +207,7 @@ export const listBugGroupsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const scope = await resolveReadScope(data.projectId, userId);
     const where = buildListWhere({

package/src/server/serverFns/bug/bug-list-query.ts

@@ -132,9 +132,13 @@ export function buildListWhere(data: {
             } else if (hasNone && realIds.length === 0) {
               andConditions.push(isNeg ? { assigneeId: { not: null } } : { assigneeId: null });
             } else if (hasNone) {
-              andConditions.push({
-                OR: [{ assigneeId: null }, { assigneeId: isNeg ? { notIn: realIds } : { in: realIds } }],
-              });
+              // is_not 语义 NOT(未指派 OR in realIds) = 非空且 notIn（testcase list-query 同款修复：
+              // 原 `OR: [null, notIn]` 把未指派重新包含进结果，勾选「不属于：未指派、张三」时未指派 BUG 仍命中）
+              andConditions.push(
+                isNeg
+                  ? { AND: [{ assigneeId: { not: null } }, { assigneeId: { notIn: realIds } }] }
+                  : { OR: [{ assigneeId: null }, { assigneeId: { in: realIds } }] },
+              );
             } else if (realIds.length > 0) {
               andConditions.push({
                 assigneeId: isNeg

package/src/server/serverFns/bug/bug-reactions.ts

@@ -41,7 +41,7 @@ export const listBugCommentReactionsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugCommentProjectMember(data.commentId, userId);
 
@@ -59,7 +59,7 @@ export const addBugCommentReactionFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugCommentProjectMember(data.commentId, userId);
 
@@ -92,7 +92,7 @@ export const toggleBugCommentReactionFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugCommentProjectMember(data.commentId, userId);
 
@@ -107,10 +107,23 @@ export const toggleBugCommentReactionFn = createServerFn({ method: "POST" })
     });
 
     if (existing) {
-      await prisma.bugCommentReaction.delete({ where: { id: existing.id } });
+      // deleteMany 按三元组删除：并发双击时一方删空为 0 行，不抛 P2025（幂等）
+      await prisma.bugCommentReaction.deleteMany({
+        where: { commentId: data.commentId, userId, emoji: data.emoji },
+      });
     } else {
-      await prisma.bugCommentReaction.create({
-        data: { commentId: data.commentId, userId, emoji: data.emoji },
+      // 与 add 同款 upsert：并发双击双 create 时一方撞三元组唯一键，
+      // update:{} 吞掉为幂等跳过，不再以裸 P2002 抛错
+      await prisma.bugCommentReaction.upsert({
+        where: {
+          commentId_userId_emoji: {
+            commentId: data.commentId,
+            userId,
+            emoji: data.emoji,
+          },
+        },
+        update: {},
+        create: { commentId: data.commentId, userId, emoji: data.emoji },
       });
     }
 

package/src/server/serverFns/bug/bug-reorder.ts

@@ -24,6 +24,7 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
+import { getAccessibleProjectIds } from "@/server/bug/bug-permissions";
 
 const reorderSchema = z.object({
   // 批量上限 500（story-crud/bulk idListSchema 同款）：防误用超大拖垮 $transaction
@@ -45,11 +46,7 @@ export const reorderBugsFn = createServerFn({ method: "POST" })
     const session = await requireAuth(request);
     // 可见性过滤进 where（SEC-03：防跨项目改他人 BUG 排序）；updateMany 对
     // 越权/不存在 id 静默跳过，不中断整批合法排序
-    const memberships = await prisma.projectMember.findMany({
-      where: { userId: session.user!.id!, status: { not: "suspended" } },
-      select: { projectId: true },
-    });
-    const visibleProjectIds = memberships.map((m) => m.projectId);
+    const visibleProjectIds = await getAccessibleProjectIds(session.user.id);
 
     await prisma.$transaction(
       data.items.map((item) =>

package/src/server/serverFns/bug/bug-repro.ts

@@ -78,7 +78,7 @@ export const runBugReproFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 
@@ -91,7 +91,7 @@ export const listReproRunsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 

package/src/server/serverFns/bug/bug-story-bulk.ts

@@ -25,19 +25,10 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
+import { getAccessibleProjectIds } from "@/server/bug/bug-permissions";
 
 const idListSchema = z.object({ bugIds: z.array(z.string()).min(1).max(500) });
 
-/** 一次取用户可访问（有效成员，suspended 视同无权限）的项目 id 集合（bulk.ts 同款口径） */
-async function accessibleProjectIds(userId: string): Promise<string[]> {
-  const prisma = await getPrisma();
-  const rows = await prisma.projectMember.findMany({
-    where: { userId, status: { not: "suspended" } },
-    select: { projectId: true },
-  });
-  return rows.map((r) => r.projectId);
-}
-
 const bulkLinkSchema = z.object({
   bugIds: z.array(z.string()).min(1).max(500),
   storyId: z.string(),
@@ -49,8 +40,8 @@ export const bulkLinkBugsToStoryFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
-    const visibleProjectIds = await accessibleProjectIds(userId);
+    const userId = session.user.id;
+    const visibleProjectIds = await getAccessibleProjectIds(userId);
 
     // story 归属校验（防跨项目挂载，testcase bulk 同口径）
     const story = await prisma.story.findUnique({
@@ -104,8 +95,8 @@ export const bulkUnlinkBugsFromStoryFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
-    const visibleProjectIds = await accessibleProjectIds(userId);
+    const userId = session.user.id;
+    const visibleProjectIds = await getAccessibleProjectIds(userId);
 
     return prisma.$transaction(async (tx) => {
       const bugs = await tx.bug.findMany({
@@ -170,7 +161,7 @@ export const listBugsByStoryFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // story 可见性：非成员静默回退空（防越权探测 storyId）
     const story = await prisma.story.findUnique({
@@ -230,7 +221,7 @@ export const listBugsForSelectFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     const projectId = await (async () => {
       // scope 解析同 listBugsFn：无效/非成员 → 回退独立项目
       const { resolveStoryScopeProjectId } = await import("@/server/builtin-project");

package/src/server/serverFns/bug/bug-story.ts

@@ -44,7 +44,7 @@ export const convertBugToStoryFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 
@@ -102,7 +102,7 @@ export const linkBugToStoryFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const projectId = await assertBugProjectMember(data.bugId, userId);
 
@@ -140,7 +140,7 @@ export const unlinkBugFromStoryFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertBugProjectMember(data.bugId, userId);
 

package/src/server/serverFns/bug/bug-views.ts

@@ -23,17 +23,14 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
+import { toJsonInput } from "@/server/lib/prisma-json";
 import {
   BUG_DISPLAY_OPTIONS_VIEW_NAME,
   type BugSavedView,
   type BugViewFilterCondition,
-} from "@/components/bug/display/types";
+} from "@/shared/bug/display-types";
 import type { Prisma } from "@allbluecn/database";
 
-function toJson<T>(value: T): Prisma.InputJsonValue {
-  return value as unknown as Prisma.InputJsonValue;
-}
-
 function toBugSavedView(row: {
   id: string;
   name: string;
@@ -70,7 +67,7 @@ export const listBugViewsFn = createServerFn({ method: "GET" }).handler(async ()
   const prisma = await getPrisma();
   const request = getRequest();
   const session = await requireAuth(request);
-  const userId = session.user!.id!;
+  const userId = session.user.id;
   const rows = await prisma.bugFilterView.findMany({
     where: { userId, ...NOT_RESERVED },
     orderBy: { createdAt: "asc" },
@@ -80,15 +77,25 @@ export const listBugViewsFn = createServerFn({ method: "GET" }).handler(async ()
 });
 
 const filterConditionSchema = z.object({
-  property: z.string(),
-  operator: z.string(),
-  value: z.string(),
+  property: z.string().max(100),
+  operator: z.string().max(64),
+  value: z.string().max(2000),
 });
 
+// filters 条数封顶（单行膨胀/存储滥用防线）
+const FILTERS_MAX = 50;
+
+/** displayOptions 为客户端状态快照 JSON（含视图 icon 侧信道字段），只限尺寸不收敛形状 */
+function assertDisplayOptionsSize(value: unknown): void {
+  if (JSON.stringify(value ?? {}).length > 65536) {
+    throw new Error("视图显示快照过大");
+  }
+}
+
 const createSchema = z.object({
   name: z.string().min(1).max(50),
   projectId: z.string().nullable().optional(),
-  filters: z.array(filterConditionSchema),
+  filters: z.array(filterConditionSchema).max(FILTERS_MAX),
   displayOptions: z.unknown(),
 });
 
@@ -101,14 +108,15 @@ export const createBugViewFn = createServerFn({ method: "POST" })
       throw new Error("该视图名称为系统保留，请换一个名称");
     }
     const prisma = await getPrisma();
-    const userId = session.user!.id!;
+    const userId = session.user.id;
+    assertDisplayOptionsSize(data.displayOptions);
     const row = await prisma.bugFilterView.create({
       data: {
         userId,
         name: data.name,
         projectId: data.projectId ?? null,
-        filters: toJson(data.filters as BugViewFilterCondition[]),
-        displayOptions: toJson(data.displayOptions),
+        filters: toJsonInput(data.filters as BugViewFilterCondition[]),
+        displayOptions: toJsonInput(data.displayOptions),
       },
       select: VIEW_SELECT,
     });
@@ -119,7 +127,7 @@ const updateSchema = z.object({
   id: z.string(),
   name: z.string().min(1).max(50).optional(),
   projectId: z.string().nullable().optional(),
-  filters: z.array(filterConditionSchema).optional(),
+  filters: z.array(filterConditionSchema).max(FILTERS_MAX).optional(),
   displayOptions: z.unknown().optional(),
 });
 
@@ -132,13 +140,14 @@ export const updateBugViewFn = createServerFn({ method: "POST" })
       throw new Error("该视图名称为系统保留，请换一个名称");
     }
     const prisma = await getPrisma();
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     const { id, ...patch } = data;
+    if (patch.displayOptions !== undefined) assertDisplayOptionsSize(patch.displayOptions);
     const updates: Record<string, unknown> = {};
     if (patch.name !== undefined) updates.name = patch.name;
     if (patch.projectId !== undefined) updates.projectId = patch.projectId;
-    if (patch.filters !== undefined) updates.filters = toJson(patch.filters as BugViewFilterCondition[]);
-    if (patch.displayOptions !== undefined) updates.displayOptions = toJson(patch.displayOptions);
+    if (patch.filters !== undefined) updates.filters = toJsonInput(patch.filters as BugViewFilterCondition[]);
+    if (patch.displayOptions !== undefined) updates.displayOptions = toJsonInput(patch.displayOptions);
     const row = await prisma.bugFilterView.update({
       // userId + 非保留名限定：他人视图与显示选项保留行均改不到（P2025 由调用方感知）
       where: { id, userId, ...NOT_RESERVED },
@@ -156,7 +165,7 @@ export const deleteBugViewFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await prisma.bugFilterView.delete({
       where: { id: data.id, userId, ...NOT_RESERVED },
     });

package/src/server/serverFns/bug/bug-webhooks.ts

@@ -30,6 +30,7 @@ import { assertFetchableUrl } from "@/server/fetch-guard";
 import { BUG_WEBHOOK_EVENTS } from "@/shared/bug/constants";
 import { TEST_RUN_WEBHOOK_EVENTS } from "../testcase/constants";
 import { assertProjectMembership } from "@/server/bug/bug-permissions";
+import { encryptWebhookSecret } from "@/server/lib/webhook-secret"
 
 /** 签名密钥：32 字节 CSPRNG → 64 字符 hex（webhook-out HMAC-SHA256 用） */
 const generateWebhookSecret = (): string => randomBytes(32).toString("hex");
@@ -63,7 +64,7 @@ export const listBugWebhooksFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     const rows = await prisma.projectWebhook.findMany({
@@ -94,7 +95,7 @@ export const createBugWebhookFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     // SEC-07 注册时校验：成员即可注册 webhook，私网/回环目标会形成服务端盲
@@ -107,7 +108,9 @@ export const createBugWebhookFn = createServerFn({ method: "POST" })
       data: {
         projectId: data.projectId,
         url: data.url,
-        secret,
+        // 静态加密（审计 A4x-3 🟡 待决策收口）：入库为 AES-256-GCM 密文（enc:v1: 前缀），
+        // 明文仅本次响应回显一次；两处投递端经 decryptWebhookSecret 解密（存量明文回退）
+        secret: encryptWebhookSecret(secret),
         events: data.events,
         enabled: true,
       },
@@ -134,7 +137,7 @@ export const deleteBugWebhookFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     // findFirst 带 projectId 收敛：越权 webhookId 与不存在同话术
@@ -155,7 +158,7 @@ export const toggleBugWebhookFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await assertProjectMembership(data.projectId, userId);
 
     const existing = await prisma.projectWebhook.findFirst({

package/src/server/serverFns/bug/test-bug-confirm.ts

@@ -47,7 +47,7 @@ export const listPendingTestRunBugsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const run = await prisma.testRun.findUnique({
       where: { id: data.runId },
@@ -85,7 +85,7 @@ export const confirmTestRunBugFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const bug = await prisma.bug.findUnique({
       where: { id: data.bugId },

package/src/server/serverFns/changelog/__tests__/fetch.test.ts

@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+
+// fetchChangelogFn 读路径鉴权自查（审计 A2x-serverfns-2 条目 1）：
+// changelog 页在 _nav 登录墙内，但 serverFn 是独立 RPC 入口——未登录直调必须拒绝，
+// 且 findMany 带 take 封顶防全表拉取。
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  requireAuth: vi.fn(),
+  developerLogFindMany: vi.fn(),
+}));
+
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: () => ({
+    handler(fn: Function) {
+      return async (args?: { data?: unknown }) => fn({ data: args?.data });
+    },
+  }),
+}));
+
+vi.mock("@tanstack/react-start/server", () => ({
+  getRequest: () => new Request("https://allblue.test/changelog"),
+}));
+
+vi.mock("@/server/auth-helpers", () => ({
+  requireAuth: mocks.requireAuth,
+}));
+
+vi.mock("@allbluecn/database/get-prisma", () => ({
+  getPrisma: async () => ({
+    developerLog: { findMany: mocks.developerLogFindMany },
+  }),
+}));
+
+import { fetchChangelogFn } from "../fetch";
+
+const row = {
+  id: "log1",
+  date: "2026-10-01",
+  year: 2026,
+  title: "t",
+  desc: "d",
+  tags: ["a"],
+  commitSha: "abc",
+  createdAt: new Date("2026-10-01T00:00:00Z"),
+  updatedAt: new Date("2026-10-01T00:00:00Z"),
+};
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  mocks.requireAuth.mockResolvedValue({ user: { id: "u1" } });
+  mocks.developerLogFindMany.mockResolvedValue([row]);
+});
+
+describe("fetchChangelogFn 读路径鉴权", () => {
+  it("未登录拒绝且不查询 developerLog", async () => {
+    mocks.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(fetchChangelogFn()).rejects.toThrow("UNAUTHORIZED");
+    expect(mocks.developerLogFindMany).not.toHaveBeenCalled();
+  });
+
+  it("登录后放行：findMany 带 isDeleted 过滤 + take 封顶，tags 归一为数组", async () => {
+    const res = await fetchChangelogFn();
+
+    expect(mocks.developerLogFindMany).toHaveBeenCalledTimes(1);
+    const arg = mocks.developerLogFindMany.mock.calls[0][0];
+    expect(arg.where).toEqual({ isDeleted: false });
+    expect(arg.take).toBe(500);
+    expect(arg.orderBy).toEqual([{ year: "desc" }, { createdAt: "desc" }]);
+    expect(res).toEqual([
+      {
+        ...row,
+        createdAt: "2026-10-01T00:00:00.000Z",
+        updatedAt: "2026-10-01T00:00:00.000Z",
+      },
+    ]);
+  });
+});

package/src/server/serverFns/changelog/__tests__/subscribe.test.ts

@@ -95,8 +95,10 @@ describe('subscribeChangelogFn', () => {
     expect(sendTemplateEmailMock).toHaveBeenCalledTimes(1)
   })
 
-  it('email 为空 → zod 拒绝', async () => {
-    await expect(invoke(subscribeChangelogFn, { email: 'nope' })).rejects.toThrow()
+  it('email 非法 → 返回 invalid_email（结构化 code，不抛错）', async () => {
+    const r = await invoke(subscribeChangelogFn, { email: 'nope' })
+    expect(r).toEqual({ status: 'invalid_email' })
+    expect(emailSubscriberMock.findUnique).not.toHaveBeenCalled()
   })
 })