@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/design/ai/providers.ts

@@ -27,7 +27,8 @@ import type {
   ModelCapability,
 } from "@allbluecn/kernel"
 import { getServerSeam } from "@allbluecn/kernel"
-import { checkAiRateLimit } from "@/server/lib/rate-limit"
+import { checkAiRateLimit, checkRateLimit } from "@/server/lib/rate-limit"
+import { toJsonInput } from "@/server/lib/prisma-json"
 import {
   listVisibleProvidersForUser,
   listEnabledModelsForUser,
@@ -35,6 +36,7 @@ import {
   fetchProviderModels,
 } from "@/server/ai-gateway"
 import { encryptApiKey, decryptApiKey } from "@/server/lib/api-key-cipher"
+import { invalidateAiConfigCache } from "@/server/ai-gateway/adapter"
 
 const PLACEHOLDER_KEYS = new Set([
   "sk-your-api-key-here",
@@ -46,11 +48,6 @@ function asCustomModels(raw: unknown): AiModelMeta[] {
   return Array.isArray(raw) ? (raw as AiModelMeta[]) : []
 }
 
-/** Prisma Json 字段不接受强类型数组（缺 index signature），统一 cast */
-function toJson(value: unknown): Prisma.InputJsonValue {
-  return value as unknown as Prisma.InputJsonValue
-}
-
 function maskKey(key: string | null | undefined): string {
   if (!key) return ""
   if (key.length <= 8) return "****"
@@ -99,7 +96,7 @@ export const listAiProvidersFn = createServerFn({ method: "GET" }).handler(
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     return listVisibleProvidersForUser(userId)
   },
 )
@@ -111,7 +108,7 @@ export const getAiProviderFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
 
     const provider = await prisma.aiProvider.findUnique({
       where: { providerId: data.providerId },
@@ -187,7 +184,7 @@ export const updateAiProviderFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     await getServerSeam().requireUserInDb(userId)
 
     const provider = await prisma.aiProvider.findUnique({
@@ -230,7 +227,7 @@ export const updateAiProviderFn = createServerFn({ method: "POST" })
     if (data.enabled !== undefined) update.enabled = data.enabled
     if (data.models !== undefined) update.models = data.models
     if (data.customModels !== undefined)
-      update.customModels = toJson(data.customModels)
+      update.customModels = toJsonInput(data.customModels)
 
     await prisma.aiProviderConfig.upsert({
       where: {
@@ -239,6 +236,8 @@ export const updateAiProviderFn = createServerFn({ method: "POST" })
       create: { userId, providerId: data.providerId, ...update },
       update,
     })
+    // 配置变更后立即失效 resolveAiConfig 缓存（默认 30s TTL 兜底）
+    invalidateAiConfigCache(userId);
     return { success: true }
   })
 
@@ -248,10 +247,12 @@ export const deleteAiProviderConfigFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     await prisma.aiProviderConfig.deleteMany({
       where: { userId, providerId: data.providerId },
     })
+    // 配置变更后立即失效 resolveAiConfig 缓存（默认 30s TTL 兜底）
+    invalidateAiConfigCache(userId);
     return { success: true }
   })
 
@@ -266,8 +267,9 @@ export const refreshModelsFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     await getServerSeam().requireUserInDb(userId)
+    await checkAiRateLimit(userId, "refreshModels")
 
     const provider = await prisma.aiProvider.findUnique({
       where: { providerId: data.providerId },
@@ -346,10 +348,12 @@ export const refreshModelsFn = createServerFn({ method: "POST" })
         create: {
           userId,
           providerId: data.providerId,
-          customModels: toJson(merged),
+          customModels: toJsonInput(merged),
         },
-        update: { customModels: toJson(merged) },
+        update: { customModels: toJsonInput(merged) },
       })
+      // 配置变更后立即失效 resolveAiConfig 缓存（默认 30s TTL 兜底）
+      invalidateAiConfigCache(userId);
     }
 
     return {
@@ -371,7 +375,7 @@ export const createCustomModelFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     await getServerSeam().requireUserInDb(userId)
 
     const provider = await prisma.aiProvider.findUnique({
@@ -414,10 +418,12 @@ export const createCustomModelFn = createServerFn({ method: "POST" })
       create: {
         userId,
         providerId: data.providerId,
-        customModels: toJson(merged),
+        customModels: toJsonInput(merged),
       },
-      update: { customModels: toJson(merged) },
+      update: { customModels: toJsonInput(merged) },
     })
+    // 配置变更后立即失效 resolveAiConfig 缓存（默认 30s TTL 兜底）
+    invalidateAiConfigCache(userId);
     return { success: true, message: `已创建模型「${data.model.displayName}」` }
   })
 
@@ -426,7 +432,7 @@ export const listEnabledModelsFn = createServerFn({ method: "GET" }).handler(
   async () => {
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     return listEnabledModelsForUser(userId)
   },
 )
@@ -444,7 +450,7 @@ export const testAiProviderFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     await checkAiRateLimit(userId, "testProvider")
 
     const provider = await prisma.aiProvider.findUnique({
@@ -486,6 +492,9 @@ export const testAiProviderFn = createServerFn({ method: "POST" })
     })
   })
 
+/** 单用户自定义 provider 数量上限（全局目录表防刷） */
+const CUSTOM_PROVIDER_MAX_PER_USER = 20
+
 /** 用户创建自定义 OpenAI 兼容服务商 */
 export const createCustomProviderFn = createServerFn({ method: "POST" })
   .validator(
@@ -500,9 +509,19 @@ export const createCustomProviderFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     await getServerSeam().requireUserInDb(userId)
 
+    // 频控：AiProvider 是全局目录表（行被所有用户的可见性查询扫描），
+    // 无限流可被单用户刷出行数膨胀
+    const rl = checkRateLimit(`customProvider:${userId}`, {
+      max: 5,
+      windowMs: 3_600_000,
+    })
+    if (!rl.allowed) {
+      throw new Error("创建自定义服务商过于频繁，请 1 小时后再试")
+    }
+
     const slug = data.displayName
       .toLowerCase()
       .replace(/[^a-z0-9\u4e00-\u9fff]+/g, "-")
@@ -519,6 +538,14 @@ export const createCustomProviderFn = createServerFn({ method: "POST" })
       throw new Error(`服务商名称与已有服务商冲突，请换一个名称`)
     }
 
+    // 数量上限：providerId 前缀即用户标识（custom-{uid8}-），按前缀计数即可圈定
+    const customCount = await prisma.aiProvider.count({
+      where: { providerId: { startsWith: `custom-${shortUid}-` } },
+    })
+    if (customCount >= CUSTOM_PROVIDER_MAX_PER_USER) {
+      throw new Error(`自定义服务商数量已达上限（${CUSTOM_PROVIDER_MAX_PER_USER} 个）`)
+    }
+
     const models: AiModelMeta[] = [
       {
         id: data.defaultModel,
@@ -528,22 +555,31 @@ export const createCustomProviderFn = createServerFn({ method: "POST" })
       },
     ]
 
-    const provider = await prisma.aiProvider.create({
-      data: {
-        providerId,
-        displayName: data.displayName,
-        brandName: data.displayName,
-        description: "用户自定义 OpenAI 兼容服务商",
-        category: "popular",
-        adapterKind: "openai-compatible",
-        defaultBaseUrl: data.baseUrl,
-        brandColor: "#6467F2",
-        isLocal: false,
-        enabled: false,
-        models: toJson(models),
-        sortOrder: 0,
-      },
-    })
+    let provider: Awaited<ReturnType<typeof prisma.aiProvider.create>>
+    try {
+      provider = await prisma.aiProvider.create({
+        data: {
+          providerId,
+          displayName: data.displayName,
+          brandName: data.displayName,
+          description: "用户自定义 OpenAI 兼容服务商",
+          category: "popular",
+          adapterKind: "openai-compatible",
+          defaultBaseUrl: data.baseUrl,
+          brandColor: "#6467F2",
+          isLocal: false,
+          enabled: false,
+          models: toJsonInput(models),
+          sortOrder: 0,
+        },
+      })
+    } catch (e) {
+      // check-then-create 竞态兜底：并发同 slug 撞 unique 时转友好文案（team.ts 同口径）
+      if ((e as { code?: string })?.code === "P2002") {
+        throw new Error("服务商名称与已有服务商冲突，请换一个名称")
+      }
+      throw e
+    }
 
     if (data.apiKey.trim()) {
       await prisma.aiProviderConfig.create({
@@ -556,6 +592,8 @@ export const createCustomProviderFn = createServerFn({ method: "POST" })
           models: models.map((m) => m.id),
         },
       })
+      // 配置变更后立即失效 resolveAiConfig 缓存（默认 30s TTL 兜底）
+      invalidateAiConfigCache(userId);
     }
 
     return {

package/src/server/serverFns/design/comments.ts

@@ -18,8 +18,10 @@
 import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
+import type { Prisma } from '@allbluecn/database'
 import { getPrisma } from '@allbluecn/database/get-prisma'
 import { getServerSeam } from '@allbluecn/kernel'
+import { assertDesignReadable, DESIGN_FORBIDDEN_MESSAGE, sessionUserId } from '@/server/design/access'
 
 const listSchema = z.object({
   designId: z.string(),
@@ -27,11 +29,17 @@ const listSchema = z.object({
   includeResolved: z.boolean().default(false),
 })
 
+// 评论随分享页公开：属主与通过门禁的分享访客（含未登录）可读；评论者 email 属 PII，
+// 仅属主可见，访客侧置 null（UI 经 maskEmail 展示，接受 null）。
 export const listCommentsFn = createServerFn({ method: 'GET' })
   .validator(listSchema)
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
-    return prisma.comment.findMany({
+    const request = getRequest()
+    const session = await getServerSeam().getCurrentSession(request)
+    const { isOwner } = await assertDesignReadable(data.designId, session?.user?.id)
+
+    const comments = await prisma.comment.findMany({
       where: {
         designId: data.designId,
         ...(data.pageId ? { pageId: data.pageId } : {}),
@@ -51,6 +59,11 @@ export const listCommentsFn = createServerFn({ method: 'GET' })
         },
       },
     })
+
+    return comments.map((comment) => ({
+      ...comment,
+      user: { ...comment.user, email: isOwner ? comment.user.email : null },
+    }))
   })
 
 const createSchema = z.object({
@@ -65,25 +78,46 @@ export const createCommentFn = createServerFn({ method: 'POST' })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    await assertDesignReadable(data.designId, userId)
+
+    if (data.pageId) {
+      const page = await prisma.designPage.findFirst({
+        where: { id: data.pageId, designId: data.designId },
+        select: { id: true },
+      })
+      if (!page) throw new Error(DESIGN_FORBIDDEN_MESSAGE)
+    }
+
     return prisma.comment.create({
       data: {
-        ...data,
-        userId: session.user!.id!,
-        position: data.position as object,
+        designId: data.designId,
+        pageId: data.pageId,
+        content: data.content,
+        userId,
+        position: data.position as Prisma.InputJsonValue | undefined,
       },
     })
   })
 
+/** 评论作者或所属 design 属主可处置（resolved 切换）；其余一律「无权限」 */
+async function setCommentResolved(id: string, userId: string, resolved: boolean) {
+  const prisma = await getPrisma()
+  const result = await prisma.comment.updateMany({
+    where: { id, OR: [{ userId }, { design: { userId } }] },
+    data: { resolved },
+  })
+  if (result.count === 0) throw new Error(DESIGN_FORBIDDEN_MESSAGE)
+}
+
 const ignoreSchema = z.object({ id: z.string() })
 
 export const ignoreCommentFn = createServerFn({ method: 'POST' })
   .validator(ignoreSchema)
   .handler(async ({ data }) => {
-    const prisma = await getPrisma()
     const request = getRequest()
-    await getServerSeam().requireAuth(request)
-    await prisma.comment.update({ where: { id: data.id }, data: { resolved: true } })
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    await setCommentResolved(data.id, userId, true)
     return { success: true }
   })
 
@@ -92,12 +126,18 @@ const updateCommentSchema = z.object({
   content: z.string().min(1).max(2000),
 })
 
+// 正文只有作者本人可改
 export const updateCommentFn = createServerFn({ method: 'POST' })
   .validator(updateCommentSchema)
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    await getServerSeam().requireAuth(request)
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    const owned = await prisma.comment.findFirst({
+      where: { id: data.id, userId },
+      select: { id: true },
+    })
+    if (!owned) throw new Error(DESIGN_FORBIDDEN_MESSAGE)
     return prisma.comment.update({ where: { id: data.id }, data: { content: data.content } })
   })
 
@@ -106,9 +146,8 @@ const resolveSchema = z.object({ id: z.string(), resolved: z.boolean() })
 export const resolveCommentFn = createServerFn({ method: 'POST' })
   .validator(resolveSchema)
   .handler(async ({ data }) => {
-    const prisma = await getPrisma()
     const request = getRequest()
-    await getServerSeam().requireAuth(request)
-    await prisma.comment.update({ where: { id: data.id }, data: { resolved: data.resolved } })
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    await setCommentResolved(data.id, userId, data.resolved)
     return { success: true }
   })

package/src/server/serverFns/design/designs.ts

@@ -19,7 +19,9 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
+import { Prisma } from '@allbluecn/database'
 import { getServerSeam } from '@allbluecn/kernel'
+import { sessionUserId } from '@/server/design/access'
 
 const listSchema = z.object({
   take: z.number().int().min(1).max(100).default(20),
@@ -32,7 +34,7 @@ export const listDesignsFn = createServerFn({ method: 'GET' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
-    const userId = session.user!.id!
+    const userId = sessionUserId(session)
     return prisma.design.findMany({
       where: { userId, isDeleted: false },
       orderBy: { createdAt: 'desc' },
@@ -72,7 +74,7 @@ export const createDesignFn = createServerFn({ method: 'POST' })
         icon: data.icon,
         name: data.name,
         description: data.description,
-        userId: session.user!.id!,
+        userId: sessionUserId(session),
         pages: {
           create: {
             name: data.homeName ?? '首页',
@@ -83,8 +85,8 @@ export const createDesignFn = createServerFn({ method: 'POST' })
               create: {
                 version: 1,
                 notes: '初始版本',
-                canvas: null as any,
-                content: null as any,
+                canvas: Prisma.DbNull,
+                content: Prisma.DbNull,
               },
             },
           },
@@ -96,7 +98,7 @@ export const createDesignFn = createServerFn({ method: 'POST' })
 const updateSchema = z.object({
   id: z.string(),
   name: z.string().min(1).max(100).optional(),
-  icon: z.string().optional(),
+  icon: z.string().max(64).optional(),
   description: z.string().max(500).nullable().optional(),
 })
 
@@ -109,7 +111,7 @@ export const updateDesignFn = createServerFn({ method: 'POST' })
     // DB-03：属主校验合并进写入（updateMany 计数判定），1 次查询替代 2 次
     const { id: _id, ...rest } = data
     const res = await prisma.design.updateMany({
-      where: { id: data.id, userId: session.user!.id!, isDeleted: false },
+      where: { id: data.id, userId: sessionUserId(session), isDeleted: false },
       data: rest,
     })
     if (res.count === 0) throw new Error('未找到或无权限')
@@ -124,7 +126,7 @@ export const deleteDesignFn = createServerFn({ method: 'POST' })
     const session = await getServerSeam().requireAuth(request)
     // DB-03：属主校验合并进写入；where 不含 isDeleted 与原 findFirst 口径一致（重复软删幂等刷新 deletedAt）
     const res = await prisma.design.updateMany({
-      where: { id: data.id, userId: session.user!.id! },
+      where: { id: data.id, userId: sessionUserId(session) },
       data: { isDeleted: true, deletedAt: new Date() },
     })
     if (res.count === 0) throw new Error('未找到或无权限')

package/src/server/serverFns/design/detail.ts

@@ -31,20 +31,21 @@ export const getDesignDetailFn = createServerFn({ method: 'GET' })
     const session = await getServerSeam().getCurrentSession(request)
     if (!session?.user?.id) return { error: 'unauthorized' as const }
 
-    const prd = await prisma.design.findFirst({
+    const design = await prisma.design.findFirst({
       where: { id: data.id, userId: session.user.id },
       select: { id: true, name: true, icon: true, description: true },
     })
-    if (!prd) return { error: 'not_found' as const }
+    if (!design) return { error: 'not_found' as const }
 
     return {
+      // 历史响应键名沿用 prd（客户端契约，勿改）；design 表新增字段时同步此处
       prd: {
-        id: prd.id,
-        name: prd.name,
-        icon: prd.icon,
-        description: prd.description,
+        id: design.id,
+        name: design.name,
+        icon: design.icon,
+        description: design.description,
       },
-      session: { user: { id: session.user.id, name: session.user.name as string | undefined, email: session.user.email as string | undefined, role: session.user.role } },
+      session: { user: { id: session.user.id, name: session.user.name ?? undefined, email: session.user.email ?? undefined, role: session.user.role } },
     }
   })
 
@@ -60,14 +61,14 @@ export const getDesignPreviewFn = createServerFn({ method: 'GET' })
     const session = await getServerSeam().getCurrentSession(request)
     if (!session?.user?.id) return { error: 'unauthorized' as const }
 
-    const prd = await prisma.design.findFirst({
+    const design = await prisma.design.findFirst({
       where: { id: data.id, userId: session.user.id, isDeleted: false },
       select: { id: true, name: true, icon: true, description: true },
     })
-    if (!prd) return { error: 'not_found' as const }
+    if (!design) return { error: 'not_found' as const }
 
     const firstPage = await prisma.designPage.findFirst({
-      where: { designId: prd.id },
+      where: { designId: design.id },
       orderBy: { order: 'asc' },
       select: { content: true },
     })
@@ -78,7 +79,7 @@ export const getDesignPreviewFn = createServerFn({ method: 'GET' })
         : null
 
     return {
-      design: { id: prd.id, name: prd.name, icon: prd.icon, description: prd.description },
+      design: { id: design.id, name: design.name, icon: design.icon, description: design.description },
       html,
     }
   })

package/src/server/serverFns/design/page-versions.ts

@@ -20,6 +20,12 @@ import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
 import { getServerSeam } from '@allbluecn/kernel'
+import { assertPageOwner, assertPageVersionOwner, sessionUserId } from '@/server/design/access'
+import { toNullableJsonInput } from '@/server/lib/prisma-json'
+
+const VERSION_NOTES_MAX = 500
+
+// 页面版本（快照）全部经 page.design.userId 归属校验：读写一律仅属主。
 
 export const listDesignPageVersionsFn = createServerFn({ method: 'GET' })
   .validator(z.object({
@@ -28,6 +34,10 @@ export const listDesignPageVersionsFn = createServerFn({ method: 'GET' })
   }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
+    const request = getRequest()
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    await assertPageOwner(data.pageId, userId)
+
     return prisma.pageVersion.findMany({
       where: { pageId: data.pageId },
       orderBy: { createdAt: 'desc' },
@@ -40,6 +50,10 @@ export const getDesignPageVersionFn = createServerFn({ method: 'GET' })
   .validator(z.object({ pageVersionId: z.string() }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
+    const request = getRequest()
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    await assertPageVersionOwner(data.pageVersionId, userId)
+
     const pageVersion = await prisma.pageVersion.findUnique({
       where: { id: data.pageVersionId },
     })
@@ -53,16 +67,17 @@ export const createDesignPageVersionFn = createServerFn({ method: 'POST' })
   .validator(z.object({
     pageId: z.string(),
     notes: z.string().optional(),
-    canvas: z.any().optional(),
-    content: z.any().optional(),
+    canvas: z.unknown().optional(),
+    content: z.unknown().optional(),
     restoredFromVersion: z.number().int().optional(),
   }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    await assertPageOwner(data.pageId, userId)
 
-    if (data.notes && data.notes.length > 500) {
+    if (data.notes && data.notes.length > VERSION_NOTES_MAX) {
       throw new Error('版本说明不能超过500字')
     }
 
@@ -72,22 +87,22 @@ export const createDesignPageVersionFn = createServerFn({ method: 'POST' })
     })
     if (!page) throw new Error('page not found')
 
-    const latestVersion = await prisma.pageVersion.findFirst({
-      where: { pageId: data.pageId },
-      orderBy: { version: 'desc' },
-      select: { version: true },
-    })
-
-    const newVersionNumber = (latestVersion?.version ?? 0) + 1
+    // 版本号分配与写入同处一个事务，避免并发快照算出相同 version
+    return prisma.$transaction(async (tx) => {
+      const latestVersion = await tx.pageVersion.findFirst({
+        where: { pageId: data.pageId },
+        orderBy: { version: 'desc' },
+        select: { version: true },
+      })
+      const newVersionNumber = (latestVersion?.version ?? 0) + 1
 
-    const result = await prisma.$transaction(async (tx) => {
       const pageVersion = await tx.pageVersion.create({
         data: {
           pageId: data.pageId,
           version: newVersionNumber,
           notes: data.notes || null,
-          canvas: (data.canvas ?? page.canvas) as any,
-          content: (data.content ?? page.content) as any,
+          canvas: toNullableJsonInput(data.canvas ?? page.canvas),
+          content: toNullableJsonInput(data.content ?? page.content),
           restoredFromVersion: data.restoredFromVersion ?? null,
         },
       })
@@ -99,23 +114,22 @@ export const createDesignPageVersionFn = createServerFn({ method: 'POST' })
 
       return pageVersion
     })
-
-    return result
   })
 
 export const updateDesignPageVersionFn = createServerFn({ method: 'POST' })
   .validator(z.object({
     pageVersionId: z.string(),
     notes: z.string().optional(),
-    canvas: z.any().optional(),
-    content: z.any().optional(),
+    canvas: z.unknown().optional(),
+    content: z.unknown().optional(),
   }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    await assertPageVersionOwner(data.pageVersionId, userId)
 
-    if (data.notes && data.notes.length > 500) {
+    if (data.notes && data.notes.length > VERSION_NOTES_MAX) {
       throw new Error('版本说明不能超过500字')
     }
 
@@ -123,8 +137,8 @@ export const updateDesignPageVersionFn = createServerFn({ method: 'POST' })
       where: { id: data.pageVersionId },
       data: {
         ...(data.notes !== undefined && { notes: data.notes || null }),
-        ...(data.canvas !== undefined && { canvas: data.canvas as any }),
-        ...(data.content !== undefined && { content: data.content as any }),
+        ...(data.canvas !== undefined && { canvas: toNullableJsonInput(data.canvas) }),
+        ...(data.content !== undefined && { content: toNullableJsonInput(data.content) }),
       },
     })
   })
@@ -134,7 +148,9 @@ export const deleteDesignPageVersionFn = createServerFn({ method: 'POST' })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    await assertPageVersionOwner(data.pageVersionId, userId)
+
     await prisma.pageVersion.delete({
       where: { id: data.pageVersionId },
     })