@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/design/__tests__/shares-password.test.ts

@@ -12,6 +12,7 @@
  * verifyDesignOwner 不 mock——真实实现跑在 mock prisma（design.findUnique）上。
  */
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import bcrypt from 'bcryptjs'
 
 // ① createServerFn 链式 mock（照抄 designs.test.ts，保留 zod validator 真实解析）
 vi.mock('@tanstack/react-start', () => {
@@ -129,10 +130,11 @@ describe('setDesignSingleSharePasswordFn 属主校验', () => {
 
     const result = (await call(setDesignSingleSharePasswordFn, { shareId: 's1' })) as any
 
-    // 返回的新密码与写入库的是同一个（generatePassword 随机生成，从 update 调用参数取回）
+    // hash-on-write：写库为 bcrypt 哈希，响应一次性回显 8 位明文，两者可互相验证
     const updateArgs = vi.mocked(prisma.share.update).mock.calls[0][0] as any
-    expect(result.password).toBe(updateArgs.data.password)
-    expect(updateArgs.data.password).toHaveLength(4)
+    expect(updateArgs.data.password).toMatch(/^\$2[aby]\$/)
+    expect(result.password).toMatch(/^[0-9A-Za-z]{8}$/)
+    await expect(bcrypt.compare(result.password, updateArgs.data.password)).resolves.toBe(true)
     expect(prisma.share.update).toHaveBeenCalledWith(
       expect.objectContaining({
         where: { id: 's1' },
@@ -185,7 +187,8 @@ describe('toggleDesignSingleSharePasswordFn 属主校验', () => {
       enabled: true,
     })) as any
 
-    expect(result).toEqual({ password: 'existing', hasPassword: true, enabled: true })
+    // 沿用存量密码：哈希不可逆，不再回显明文（password null），属主查看走重新生成
+    expect(result).toEqual({ password: null, hasPassword: true, enabled: true })
     expect(prisma.share.update).toHaveBeenCalledWith({
       where: { id: 's1' },
       data: { hasPassword: true, updatedAt: expect.any(Date) },
@@ -207,10 +210,13 @@ describe('toggleDesignSingleSharePasswordFn 属主校验', () => {
       status: 'ACTIVE',
     } as never)
 
-    await call(toggleDesignSingleSharePasswordFn, { shareId: 's1', enabled: true })
+    const result = (await call(toggleDesignSingleSharePasswordFn, { shareId: 's1', enabled: true })) as any
 
     const updateArgs = vi.mocked(prisma.share.update).mock.calls[0][0] as any
     expect(updateArgs.data.hasPassword).toBe(true)
-    expect(updateArgs.data.password).toHaveLength(4)
+    // 新生成密码：库中 bcrypt 哈希、响应一次性明文，互相验证
+    expect(updateArgs.data.password).toMatch(/^\$2[aby]\$/)
+    expect(result.password).toMatch(/^[0-9A-Za-z]{8}$/)
+    await expect(bcrypt.compare(result.password, updateArgs.data.password)).resolves.toBe(true)
   })
 })

package/src/server/serverFns/design/ai/__tests__/agent-conversations.test.ts

@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+
+// Agent 会话 serverFn 的 designId 属主校验（审计 A2x-serverfns-2）：
+// 会话读写已按 userId 圈定，但 designId 是客户端任意传入的关联键——
+// create/clear 必须先过 assertDesignOwner，防向他人 design 挂垃圾会话行。
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  requireAuth: vi.fn(),
+  assertDesignOwner: vi.fn(),
+  agentConversationFindMany: vi.fn(),
+  agentConversationCreate: vi.fn(),
+  agentConversationDeleteMany: vi.fn(),
+  agentConversationFindFirst: vi.fn(),
+  agentMessageFindMany: vi.fn(),
+  agentMessageCreate: vi.fn(),
+  agentConversationUpdate: vi.fn(),
+}));
+
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: () => ({
+    validator(schema: { parse: (v: unknown) => unknown }) {
+      const api = {
+        _validator: schema,
+        handler(fn: Function) {
+          const validator = (this as { _validator?: { parse: (v: unknown) => unknown } })
+            ._validator;
+          return async (args: { data?: unknown }) => {
+            let data = args?.data;
+            if (validator && data !== undefined) data = validator.parse(data);
+            return fn({ data });
+          };
+        },
+      };
+      return api;
+    },
+  }),
+}));
+
+vi.mock("@tanstack/react-start/server", () => ({
+  getRequest: () => new Request("https://allblue.test/"),
+}));
+
+vi.mock("@allbluecn/database/get-prisma", () => ({
+  getPrisma: async () => ({
+    agentConversation: {
+      findMany: mocks.agentConversationFindMany,
+      create: mocks.agentConversationCreate,
+      deleteMany: mocks.agentConversationDeleteMany,
+      findFirst: mocks.agentConversationFindFirst,
+      update: mocks.agentConversationUpdate,
+    },
+    agentMessage: {
+      findMany: mocks.agentMessageFindMany,
+      create: mocks.agentMessageCreate,
+    },
+  }),
+}));
+
+vi.mock("@/server/design/access", () => ({
+  assertDesignOwner: mocks.assertDesignOwner,
+}));
+
+// getServerSeam 来自 @allbluecn/kernel（真实包），这里替 requireAuth 打桩
+vi.mock("@allbluecn/kernel", () => ({
+  getServerSeam: () => ({ requireAuth: mocks.requireAuth }),
+}));
+
+import {
+  clearAgentConversationsFn,
+  createAgentConversationFn,
+} from "../agent-conversations";
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  mocks.requireAuth.mockResolvedValue({ user: { id: "u1" } });
+  mocks.assertDesignOwner.mockResolvedValue(undefined);
+  mocks.agentConversationCreate.mockResolvedValue({ id: "conv1" });
+  mocks.agentConversationDeleteMany.mockResolvedValue({ count: 0 });
+});
+
+describe("createAgentConversationFn designId 属主校验", () => {
+  it("非本人 design → 拒绝且不落库", async () => {
+    mocks.assertDesignOwner.mockRejectedValue(new Error("无权限"));
+
+    await expect(
+      createAgentConversationFn({ data: { designId: "d-other" } }),
+    ).rejects.toThrow("无权限");
+    expect(mocks.agentConversationCreate).not.toHaveBeenCalled();
+  });
+
+  it("本人 design → 先校验属主再创建", async () => {
+    await createAgentConversationFn({ data: { designId: "d1" } });
+
+    expect(mocks.assertDesignOwner).toHaveBeenCalledWith("d1", "u1");
+    expect(mocks.agentConversationCreate).toHaveBeenCalledWith({
+      data: { userId: "u1", designId: "d1", title: "新会话" },
+    });
+  });
+
+  it("未登录拒绝且不做属主校验", async () => {
+    mocks.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(
+      createAgentConversationFn({ data: { designId: "d1" } }),
+    ).rejects.toThrow("UNAUTHORIZED");
+    expect(mocks.assertDesignOwner).not.toHaveBeenCalled();
+  });
+});
+
+describe("clearAgentConversationsFn designId 属主校验", () => {
+  it("非本人 design → 拒绝且不删除", async () => {
+    mocks.assertDesignOwner.mockRejectedValue(new Error("无权限"));
+
+    await expect(
+      clearAgentConversationsFn({ data: { designId: "d-other" } }),
+    ).rejects.toThrow("无权限");
+    expect(mocks.agentConversationDeleteMany).not.toHaveBeenCalled();
+  });
+
+  it("本人 design → 校验属主后清除", async () => {
+    const res = await clearAgentConversationsFn({ data: { designId: "d1" } });
+
+    expect(mocks.assertDesignOwner).toHaveBeenCalledWith("d1", "u1");
+    expect(mocks.agentConversationDeleteMany).toHaveBeenCalledWith({
+      where: { userId: "u1", designId: "d1" },
+    });
+    expect(res).toEqual({ cleared: true });
+  });
+});

package/src/server/serverFns/design/ai/__tests__/providers.test.ts

@@ -0,0 +1,187 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+
+// design/ai/providers.ts 审计补口测试（A2x-serverfns-2）：
+// ① refreshModelsFn 出网前补 per-user 频控（与 testProvider 同口径）
+// ② createCustomProviderFn 频控 + 单用户数量上限 + P2002 竞态转友好文案
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  requireAuth: vi.fn(),
+  requireUserInDb: vi.fn(),
+  checkAiRateLimit: vi.fn(),
+  checkRateLimit: vi.fn(),
+  aiProviderFindUnique: vi.fn(),
+  aiProviderCount: vi.fn(),
+  aiProviderCreate: vi.fn(),
+  aiProviderConfigFindUnique: vi.fn(),
+  aiProviderConfigCreate: vi.fn(),
+  aiProviderConfigUpsert: vi.fn(),
+  fetchProviderModels: vi.fn(),
+}));
+
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: () => {
+    const api = {
+      _validator: undefined as { parse: (v: unknown) => unknown } | undefined,
+      validator(schema: { parse: (v: unknown) => unknown }) {
+        this._validator = schema;
+        return this;
+      },
+      handler(fn: Function) {
+        const validator = this._validator;
+        return async (args: { data?: unknown }) => {
+          let data = args?.data;
+          if (validator && data !== undefined) data = validator.parse(data);
+          return fn({ data });
+        };
+      },
+    };
+    return api;
+  },
+}));
+
+vi.mock("@tanstack/react-start/server", () => ({
+  getRequest: () => new Request("https://allblue.test/"),
+}));
+
+vi.mock("@allbluecn/database/get-prisma", () => ({
+  getPrisma: async () => ({
+    aiProvider: {
+      findUnique: mocks.aiProviderFindUnique,
+      count: mocks.aiProviderCount,
+      create: mocks.aiProviderCreate,
+    },
+    aiProviderConfig: {
+      findUnique: mocks.aiProviderConfigFindUnique,
+      create: mocks.aiProviderConfigCreate,
+      upsert: mocks.aiProviderConfigUpsert,
+    },
+  }),
+}));
+
+vi.mock("@/server/lib/prisma-json", () => ({
+  toJsonInput: (v: unknown) => v,
+}));
+
+vi.mock("@/server/lib/api-key-cipher", () => ({
+  encryptApiKey: (v: string) => `enc(${v})`,
+  decryptApiKey: (v: string | null | undefined) => v ?? null,
+}));
+
+vi.mock("@/server/lib/rate-limit", () => ({
+  checkAiRateLimit: mocks.checkAiRateLimit,
+  checkRateLimit: mocks.checkRateLimit,
+}));
+
+vi.mock("@/server/ai-gateway", () => ({
+  listVisibleProvidersForUser: vi.fn(),
+  listEnabledModelsForUser: vi.fn(),
+  checkProviderConnectivity: vi.fn(),
+  fetchProviderModels: mocks.fetchProviderModels,
+}));
+
+vi.mock("@allbluecn/kernel", () => ({
+  getServerSeam: () => ({
+    requireAuth: mocks.requireAuth,
+    requireUserInDb: mocks.requireUserInDb,
+  }),
+  // 本测试经 providers.ts → adapter.ts（invalidateAiConfigCache）引入 seam 注册调用
+  registerPrismaSeam: vi.fn(),
+}));
+
+import { createCustomProviderFn, refreshModelsFn } from "../providers";
+
+const providerRow = (over: Record<string, unknown> = {}) => ({
+  isLocal: false,
+  defaultBaseUrl: "https://api.example.com",
+  models: [],
+  displayName: "示例",
+  ...over,
+});
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  mocks.requireAuth.mockResolvedValue({ user: { id: "u1" } });
+  mocks.requireUserInDb.mockResolvedValue(undefined);
+  mocks.checkAiRateLimit.mockResolvedValue(undefined);
+  mocks.checkRateLimit.mockReturnValue({ allowed: true, retryAfterMs: 0 });
+  // create 路径默认查无同名冲突；refreshModels 用例自行覆盖为 providerRow
+  mocks.aiProviderFindUnique.mockResolvedValue(null);
+  mocks.aiProviderCount.mockResolvedValue(0);
+  mocks.aiProviderConfigFindUnique.mockResolvedValue({
+    apiKey: "enc(sk-1)",
+    baseUrl: null,
+    customModels: [],
+  });
+  mocks.fetchProviderModels.mockResolvedValue([]);
+  mocks.aiProviderCreate.mockResolvedValue({ displayName: "示例" });
+  mocks.aiProviderConfigCreate.mockResolvedValue({});
+});
+
+describe("refreshModelsFn 频控", () => {
+  beforeEach(() => {
+    mocks.aiProviderFindUnique.mockResolvedValue(providerRow());
+  });
+
+  it("出网前按 userId 调 checkAiRateLimit(refreshModels)", async () => {
+    await refreshModelsFn({ data: { providerId: "p1" } });
+
+    expect(mocks.checkAiRateLimit).toHaveBeenCalledWith("u1", "refreshModels");
+    expect(mocks.fetchProviderModels).toHaveBeenCalledTimes(1);
+  });
+
+  it("频控抛错时不发起出网请求", async () => {
+    mocks.checkAiRateLimit.mockRejectedValue(new Error("Rate limit exceeded"));
+    await expect(refreshModelsFn({ data: { providerId: "p1" } })).rejects.toThrow(
+      "Rate limit exceeded",
+    );
+    expect(mocks.fetchProviderModels).not.toHaveBeenCalled();
+  });
+});
+
+describe("createCustomProviderFn 防刷与竞态", () => {
+  const payload = {
+    displayName: "我的中转",
+    baseUrl: "https://relay.example.com",
+    apiKey: "sk-1",
+    defaultModel: "gpt-x",
+  };
+
+  it("per-user 频控超限 → 拒绝且不写库", async () => {
+    mocks.checkRateLimit.mockReturnValue({ allowed: false, retryAfterMs: 1 });
+
+    await expect(createCustomProviderFn({ data: payload })).rejects.toThrow(
+      "创建自定义服务商过于频繁",
+    );
+    expect(mocks.aiProviderCreate).not.toHaveBeenCalled();
+  });
+
+  it("单用户自定义数量达上限 → 拒绝且不写库", async () => {
+    mocks.aiProviderCount.mockResolvedValue(20);
+
+    await expect(createCustomProviderFn({ data: payload })).rejects.toThrow(
+      "数量已达上限",
+    );
+    expect(mocks.aiProviderCreate).not.toHaveBeenCalled();
+  });
+
+  it("P2002 竞态（并发同 slug 撞 unique）→ 友好文案而非裸 Prisma 错误", async () => {
+    mocks.aiProviderCreate.mockRejectedValue({ code: "P2002" });
+
+    await expect(createCustomProviderFn({ data: payload })).rejects.toThrow(
+      "服务商名称与已有服务商冲突",
+    );
+    // 前置 count 已执行（上限检查在 create 之前）
+    expect(mocks.aiProviderCount).toHaveBeenCalledWith({
+      where: { providerId: { startsWith: "custom-u1-" } },
+    });
+  });
+
+  it("其他写库错误原样抛出", async () => {
+    mocks.aiProviderCreate.mockRejectedValue(new Error("db down"));
+
+    await expect(createCustomProviderFn({ data: payload })).rejects.toThrow("db down");
+  });
+});

package/src/server/serverFns/design/ai/agent-conversations.ts

@@ -20,6 +20,10 @@ import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { getServerSeam } from "@allbluecn/kernel"
+import { assertDesignOwner } from "@/server/design/access"
+
+// 会话消息一次返回上限：Agent 会话量级有限，封顶防异常长会话一次性大返回
+const MESSAGES_LIMIT = 500
 
 /** 列出用户在某个 PRD 下的所有 Agent 会话 */
 export const listAgentConversationsFn = createServerFn({ method: "GET" })
@@ -29,7 +33,7 @@ export const listAgentConversationsFn = createServerFn({ method: "GET" })
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
     return prisma.agentConversation.findMany({
-      where: { userId: session.user!.id!, designId: data.designId },
+      where: { userId: session.user.id, designId: data.designId },
       orderBy: { updatedAt: "desc" },
       select: { id: true, title: true, createdAt: true, updatedAt: true },
     })
@@ -42,9 +46,12 @@ export const createAgentConversationFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
+    const userId = session.user.id
+    // designId 是客户端任意传入的关联键，创建前校验属主，防向他人 design 挂垃圾会话行
+    await assertDesignOwner(data.designId, userId)
     return prisma.agentConversation.create({
       data: {
-        userId: session.user!.id!,
+        userId,
         designId: data.designId,
         title: data.title ?? "新会话",
       },
@@ -59,7 +66,7 @@ export const deleteAgentConversationFn = createServerFn({ method: "POST" })
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
     await prisma.agentConversation.deleteMany({
-      where: { id: data.id, userId: session.user!.id! },
+      where: { id: data.id, userId: session.user.id },
     })
     return { deleted: true }
   })
@@ -71,8 +78,11 @@ export const clearAgentConversationsFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
+    const userId = session.user.id
+    // 与 create 同口径：designId 非本人 design 时拒绝，避免以他人 designId 维度清写
+    await assertDesignOwner(data.designId, userId)
     await prisma.agentConversation.deleteMany({
-      where: { userId: session.user!.id!, designId: data.designId },
+      where: { userId, designId: data.designId },
     })
     return { cleared: true }
   })
@@ -85,14 +95,15 @@ export const getAgentMessagesFn = createServerFn({ method: "GET" })
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
     const conv = await prisma.agentConversation.findFirst({
-      where: { id: data.conversationId, userId: session.user!.id! },
+      where: { id: data.conversationId, userId: session.user.id },
       select: { id: true },
     })
     if (!conv) throw new Error("会话不存在")
-    // DB-05：白名单 select，避免整行返回
+    // DB-05：白名单 select，避免整行返回；take 封顶防异常长会话一次性大返回
     return prisma.agentMessage.findMany({
       where: { conversationId: data.conversationId },
       orderBy: { createdAt: "asc" },
+      take: MESSAGES_LIMIT,
       select: {
         id: true,
         role: true,
@@ -120,10 +131,11 @@ export const saveAgentMessageFn = createServerFn({ method: "POST" })
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
     const conv = await prisma.agentConversation.findFirst({
-      where: { id: data.conversationId, userId: session.user!.id! },
+      where: { id: data.conversationId, userId: session.user.id },
       select: { id: true },
     })
     if (!conv) throw new Error("会话不存在")
+    // DB-05 对齐：create 返回改白名单 select（消费方不读返回值，仅防整行外泄）
     const msg = await prisma.agentMessage.create({
       data: {
         conversationId: data.conversationId,
@@ -132,6 +144,14 @@ export const saveAgentMessageFn = createServerFn({ method: "POST" })
         components: data.components as never,
         isError: data.isError,
       },
+      select: {
+        id: true,
+        role: true,
+        content: true,
+        components: true,
+        isError: true,
+        createdAt: true,
+      },
     })
     await prisma.agentConversation.update({
       where: { id: data.conversationId },

package/src/server/serverFns/design/ai/fill-annotation.ts

@@ -19,25 +19,33 @@ import { createServerFn } from "@tanstack/react-start"
 import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
 import { getServerSeam } from "@allbluecn/kernel"
+import { checkAiRateLimit } from "@/server/lib/rate-limit"
 import { runChatWithModel } from "@/server/ai-gateway"
 import { buildFillPrompt } from "@/server/design/annotation-prompt"
 
-const inputSchema = z.object({
-  componentType: z.string(),
-  componentName: z.string(),
-  commentTemplate: z.string().optional(),
-  editableProps: z
-    .array(
-      z.object({
-        key: z.string(),
-        label: z.string(),
-        type: z.string(),
-      }),
-    )
-    .optional(),
-  overrides: z.record(z.string(), z.unknown()).optional(),
-  model: z.string().optional(),
-})
+const inputSchema = z
+  .object({
+    componentType: z.string().max(200),
+    componentName: z.string().max(200),
+    commentTemplate: z.string().max(20000).optional(),
+    editableProps: z
+      .array(
+        z.object({
+          key: z.string().max(200),
+          label: z.string().max(200),
+          type: z.string().max(64),
+        }),
+      )
+      .max(200)
+      .optional(),
+    overrides: z.record(z.string().max(200), z.unknown()).optional(),
+    model: z.string().max(200).optional(),
+  })
+  // overrides 为客户端任意 JSON 快照，序列化尺寸封顶防超长 prompt 注入
+  .refine(
+    (v) => v.overrides === undefined || JSON.stringify(v.overrides).length <= 65536,
+    { message: "overrides 数据过大" },
+  )
 
 export interface FillAnnotationResult {
   html: string
@@ -56,6 +64,8 @@ export const fillAnnotationFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
+    // 托管 AI 计费调用，与同域 generatePrototype 同口径 per-user 频控
+    await checkAiRateLimit(session.user.id, "fillAnnotation")
 
     const systemPrompts = await buildFillPrompt({
       type: data.componentType,
@@ -69,7 +79,7 @@ export const fillAnnotationFn = createServerFn({ method: "POST" })
       [{ role: "user", content: "请根据组件信息填充注释模板。" }],
       {
         systemPrompts,
-        userId: session.user!.id!,
+        userId: session.user.id,
         model: data.model,
       },
     )

package/src/server/serverFns/design/ai/generate-prototype.ts

@@ -40,7 +40,7 @@ export const generatePrototypeFn = createServerFn({ method: "POST" })
     // 前端按模型能力选择通道；本入口保留旧一次性 JSON 返回形态，不删除。
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
-    await checkAiRateLimit(session.user!.id!, "generatePrototype")
+    await checkAiRateLimit(session.user.id, "generatePrototype")
     const { prompt, model } = data
 
     const types = [...serverRegisteredTypes()]
@@ -56,7 +56,7 @@ export const generatePrototypeFn = createServerFn({ method: "POST" })
       "design.prototype",
       [{ role: "user", content: prompt }],
       {
-        userId: session.user!.id!,
+        userId: session.user.id,
         model,
         promptVars: { schemaHint: buildSceneSchemaHint(types), catalog },
       },
@@ -67,7 +67,12 @@ export const generatePrototypeFn = createServerFn({ method: "POST" })
       const scene = sanitizeAiScene(parsed.scene, new Set(types))
       // JSON 往返：剥离 undefined 键（zod .optional() 保留 undefined）+ 通过 serverFn 序列化校验
       return JSON.parse(JSON.stringify({ message: parsed.message, scene })) as PrototypeResult
-    } catch {
+    } catch (e) {
+      // 原始错误 + raw 片段落服务端日志，畸形 payload 排障有据可查（providers.ts 同口径）
+      console.error("[generatePrototype] AI 返回解析失败", {
+        reason: e instanceof Error ? e.message : String(e),
+        raw: raw.slice(0, 500),
+      })
       throw new Error("AI 返回内容无法解析为 JSON，请重试")
     }
   })