@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/design/pages.ts

@@ -19,24 +19,11 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
+import { Prisma } from '@allbluecn/database'
 import { getServerSeam } from '@allbluecn/kernel'
 import { buildRoomName } from '@allbluecn/collab-core/rooms'
 import { withCollabGuard } from '@/server/collab/write-guard'
-
-async function verifyDesignOwner(designId: string, userId: string) {
-  const prisma = await getPrisma()
-  const prd = await prisma.design.findUnique({ where: { id: designId }, select: { userId: true } })
-  return prd?.userId === userId
-}
-
-async function verifyPageOwner(pageId: string, userId: string) {
-  const prisma = await getPrisma()
-  const page = await prisma.designPage.findUnique({
-    where: { id: pageId },
-    select: { design: { select: { userId: true } } },
-  })
-  return page?.design.userId === userId
-}
+import { assertDesignOwner, assertPageOwner, sessionUserId } from '@/server/design/access'
 
 export const listDesignPagesFn = createServerFn({ method: 'GET' })
   .validator(z.object({
@@ -46,10 +33,8 @@ export const listDesignPagesFn = createServerFn({ method: 'GET' })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-    if (!(await verifyDesignOwner(data.designId, session.user!.id!))) {
-      throw new Error('无权限')
-    }
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    await assertDesignOwner(data.designId, userId)
     return prisma.designPage.findMany({
       where: { designId: data.designId },
       orderBy: { order: 'asc' },
@@ -68,10 +53,8 @@ export const createDesignPageFn = createServerFn({ method: 'POST' })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-    if (!(await verifyDesignOwner(data.designId, session.user!.id!))) {
-      throw new Error('无权限')
-    }
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    await assertDesignOwner(data.designId, userId)
     const maxOrder = await prisma.designPage.aggregate({
       where: { designId: data.designId, parentId: data.parentId ?? null },
       _max: { order: true },
@@ -93,8 +76,8 @@ export const createDesignPageFn = createServerFn({ method: 'POST' })
             pageId: page.id,
             version: 1,
             notes: '初始版本',
-            canvas: null as any,
-            content: null as any,
+            canvas: Prisma.DbNull,
+            content: Prisma.DbNull,
           },
         })
       }
@@ -115,14 +98,13 @@ export const updateDesignPageFn = createServerFn({ method: 'POST' })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-    const userId = session.user!.id!
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
     // §5.3 写入门卫（任务 29）：Y 属主面 = canvas（整场景 replace 语义）+
     // content（文档 fragment 面）。快照存在 → 转发 collab 内部通道（活跃判定
     // 在 collab 侧）；无快照 pass-through、不可达 TTL 降级 → 照旧直写（非协同
     // 态零行为变化）。元数据（name/parentId/order）不归 Y——无属主面时连门卫
     // 都不进（直写即正确路由）。门卫放事务外（T21 教训：网络 I/O 不进事务）；
-    // 本路径无事务。属主预检（C1）在转发前执行（verifyPageOwner = 直写 WHERE
+    // 本路径无事务。属主预检（C1）在转发前执行（assertPageOwner = 直写 WHERE
     // 的同口径）。
     const forwarded =
       data.canvas !== undefined || data.content !== undefined
@@ -136,9 +118,7 @@ export const updateDesignPageFn = createServerFn({ method: 'POST' })
                 ...(data.content !== undefined && { content: data.content }),
               },
               assertWriteAllowed: async () => {
-                if (!(await verifyPageOwner(data.pageId, userId))) {
-                  throw new Error('无权限')
-                }
+                await assertPageOwner(data.pageId, userId)
               },
             })
           ).kind === 'forwarded'
@@ -192,10 +172,8 @@ export const deleteDesignPageFn = createServerFn({ method: 'POST' })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-    if (!(await verifyPageOwner(data.pageId, session.user!.id!))) {
-      throw new Error('无权限')
-    }
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    await assertPageOwner(data.pageId, userId)
     await prisma.$transaction(async (tx) => {
       const descendants = await tx.$queryRaw<Array<{ id: string }>>`
         WITH RECURSIVE tree AS (
@@ -223,10 +201,10 @@ export const getDesignPageFn = createServerFn({ method: 'GET' })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
     // DB-03：属主校验（经 design.userId 关系过滤）与读取合并为单查询
     const page = await prisma.designPage.findFirst({
-      where: { id: data.pageId, design: { userId: session.user!.id! } },
+      where: { id: data.pageId, design: { userId } },
       select: { canvas: true, content: true, updatedAt: true },
     })
     if (!page) throw new Error('无权限')

package/src/server/serverFns/design/reviews.ts

@@ -20,6 +20,7 @@ import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
 import { getServerSeam } from '@allbluecn/kernel'
+import { assertDesignReadable, sessionUserId } from '@/server/design/access'
 
 const upsertReviewSchema = z.object({
   designId: z.string(),
@@ -33,14 +34,22 @@ export const upsertReviewFn = createServerFn({ method: 'POST' })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    // 审批由分享页评审面板发起（ShareReviewPanel）：属主与通过门禁的分享访客（需登录）皆可评审，
+    // 不能收成属主专用；versionId 必须属于同一 design，否则可借他人 versionId 污染审批记录
+    await assertDesignReadable(data.designId, userId)
+    const version = await prisma.designVersion.findFirst({
+      where: { id: data.versionId, designId: data.designId },
+      select: { id: true },
+    })
+    if (!version) throw new Error('无权限')
 
     const existing = await prisma.review.findFirst({
       where: { designId: data.designId, versionId: data.versionId },
       select: { id: true },
     })
 
-    const status = data.status as any
+    const status = data.status
 
     let review: { id: string; status: string }
     if (existing) {
@@ -49,7 +58,7 @@ export const upsertReviewFn = createServerFn({ method: 'POST' })
         data: {
           status,
           notes: data.notes || undefined,
-          reviewerId: session.user!.id!,
+          reviewerId: userId,
           completedAt: ['APPROVED', 'REJECTED'].includes(data.status) ? new Date() : null,
         },
       })
@@ -60,12 +69,12 @@ export const upsertReviewFn = createServerFn({ method: 'POST' })
           versionId: data.versionId,
           status,
           notes: data.notes || undefined,
-          reviewerId: session.user!.id!,
+          reviewerId: userId,
         },
       })
     }
 
-    return review as any
+    return review
   })
 
 const getReviewSchema = z.object({
@@ -78,12 +87,13 @@ export const getReviewFn = createServerFn({ method: 'GET' })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    await getServerSeam().requireAuth(request)
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    await assertDesignReadable(data.designId, userId)
 
     const review = await prisma.review.findFirst({
       where: { designId: data.designId, versionId: data.versionId },
       include: { reviewer: { select: { username: true } } },
     })
 
-    return (review || { status: 'PENDING' }) as any
+    return review ?? { status: 'PENDING' as const }
   })

package/src/server/serverFns/design/share/__tests__/share-metadata.test.ts

@@ -0,0 +1,105 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+
+/**
+ * getDesignShareFn 门禁元数据回归（审计 2026-10-25 🟡：INACTIVE/过期分享仍回显
+ * design name/icon/description 的低危泄露）。钉死口径：
+ * - ACTIVE 且未过期 → 回显最小 DTO（id/token/hasPassword/versionIds/design 元数据），
+ *   且不含 password/status/expiresAt 列；
+ * - DISABLED / 已过期 → share 收敛为 null + isActive=false（客户端渲染「分享已关闭」）；
+ * - design 无任何 prd 分享 → error: 'not_found'。
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ZodType } from 'zod'
+
+vi.mock('@tanstack/react-start', () => {
+  const createServerFn = () => {
+    const api: any = {
+      validator(schema: ZodType) {
+        api._validator = schema
+        return api
+      },
+      handler(fn: (args: { data: unknown }) => unknown) {
+        return async (args: { data: unknown }) => {
+          let data = args?.data
+          if (api._validator && data !== undefined) data = api._validator.parse(data)
+          return fn({ data })
+        }
+      },
+    }
+    return api
+  }
+  return { createServerFn }
+})
+vi.mock('@tanstack/react-start/server', () => ({ getRequest: () => ({}) }))
+
+const mocks = vi.hoisted(() => ({ prisma: { share: { findFirst: vi.fn(), findMany: vi.fn() }, designVersion: { findFirst: vi.fn() } } }))
+vi.mock('@allbluecn/database/get-prisma', () => ({ getPrisma: async () => mocks.prisma }))
+
+import { getDesignShareFn } from '../../share'
+
+const call = (fn: unknown, data: Record<string, unknown>) =>
+  (fn as (args: unknown) => Promise<unknown>)({ data })
+
+const DESIGN_ID = 'd1'
+const DESIGN_META = { id: DESIGN_ID, name: '画板', icon: 'pen', description: '描述' }
+const ACTIVE_SHARE = {
+  id: 's1',
+  token: 'tok',
+  password: 'xY12',
+  hasPassword: false,
+  status: 'ACTIVE',
+  expiresAt: null,
+  shareVersions: [{ versionId: 'v1' }],
+  design: DESIGN_META,
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('getDesignShareFn 门禁元数据', () => {
+  it('ACTIVE 未过期 → 最小 DTO（含 design 元数据，不含 password/status/expiresAt）', async () => {
+    mocks.prisma.share.findFirst.mockResolvedValue(ACTIVE_SHARE)
+
+    const res = (await call(getDesignShareFn, { designId: DESIGN_ID })) as Record<string, unknown>
+
+    expect(res.isActive).toBe(true)
+    const share = res.share as Record<string, unknown>
+    expect(share).toMatchObject({ id: 's1', hasPassword: false, versionIds: ['v1'] })
+    expect(share.design).toEqual(DESIGN_META)
+    expect(share).not.toHaveProperty('password')
+    expect(share).not.toHaveProperty('status')
+    expect(share).not.toHaveProperty('expiresAt')
+  })
+
+  it('DISABLED → share 收敛为 null、isActive=false，不泄露设计元数据', async () => {
+    mocks.prisma.share.findFirst.mockResolvedValue({ ...ACTIVE_SHARE, status: 'DISABLED' })
+
+    const res = (await call(getDesignShareFn, { designId: DESIGN_ID })) as Record<string, unknown>
+
+    expect(res.isActive).toBe(false)
+    expect(res.share).toBeNull()
+  })
+
+  it('已过期 → 同 DISABLED 口径', async () => {
+    mocks.prisma.share.findFirst.mockResolvedValue({
+      ...ACTIVE_SHARE,
+      expiresAt: new Date(Date.now() - 1000),
+    })
+
+    const res = (await call(getDesignShareFn, { designId: DESIGN_ID })) as Record<string, unknown>
+
+    expect(res.isActive).toBe(false)
+    expect(res.share).toBeNull()
+  })
+
+  it('无 prd 分享 → not_found', async () => {
+    mocks.prisma.share.findFirst.mockResolvedValue(null)
+
+    const res = (await call(getDesignShareFn, { designId: DESIGN_ID })) as Record<string, unknown>
+
+    expect(res.error).toBe('not_found')
+  })
+})

package/src/server/serverFns/design/share/__tests__/share-versions.test.ts

@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/**
+ * 分享数据面密码门禁（审计 2026-10-25 🔴：getShareVersionsFn / getShareVersionDataFn 不校验密码，
+ * RPC 直连可绕过前端密码门）。版本可见性 = 经 ShareVersion 关联到 ACTIVE 分享 且 分享通过门禁。
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ZodType } from 'zod'
+
+const mocks = vi.hoisted(() => ({
+  cookies: new Map<string, string>(),
+  prisma: {
+    shareVersion: { findMany: vi.fn() },
+    designVersion: { findMany: vi.fn(), findFirst: vi.fn() },
+    designPage: { findMany: vi.fn() },
+  },
+}))
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => ({
+    validator: (schema: ZodType) => ({
+      handler: (fn: (args: { data: unknown }) => unknown) => async (args: { data: unknown }) =>
+        fn({ data: schema.parse(args.data) }),
+    }),
+  }),
+}))
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: () => new Request('https://allblue.test/share'),
+  getCookie: (name: string) => mocks.cookies.get(name),
+  setCookie: (name: string, value: string) => {
+    mocks.cookies.set(name, value)
+  },
+}))
+vi.mock('@allbluecn/database', () => ({ prisma: mocks.prisma }))
+
+import { getShareVersionDataFn, getShareVersionsFn } from '../versions'
+import { issueShareAccess } from '@/server/design/share-access'
+
+type Fn = (args: { data: unknown }) => Promise<unknown>
+const listVersions = getShareVersionsFn as unknown as Fn
+const versionData = getShareVersionDataFn as unknown as Fn
+
+const DESIGN = 'd1'
+const openShare = { id: 's-open', hasPassword: false }
+const lockedShare = { id: 's-locked', hasPassword: true }
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  vi.stubEnv('AUTH_SECRET', 'unit-test-secret')
+  mocks.cookies.clear()
+  mocks.prisma.designVersion.findMany.mockResolvedValue([{ id: 'v1', versionLabel: 'v1' }])
+  mocks.prisma.designVersion.findFirst.mockResolvedValue({
+    id: 'v1',
+    versionLabel: 'v1',
+    notes: null,
+    pageVersions: [{ pageId: 'p1', pageName: 'P', version: 1, canvas: [], content: '' }],
+  })
+})
+
+afterEach(() => {
+  vi.unstubAllEnvs()
+})
+
+describe('getShareVersionsFn', () => {
+  it('版本未关联任何 ACTIVE 分享 → 空列表，不读版本表', async () => {
+    mocks.prisma.shareVersion.findMany.mockResolvedValue([])
+    expect(await listVersions({ data: { designId: DESIGN, versionIds: ['v1'] } })).toEqual({ versions: [] })
+    expect(mocks.prisma.designVersion.findMany).not.toHaveBeenCalled()
+  })
+
+  it('分享查询按 designId + ACTIVE + 未过期过滤（不限 prd 类型，prd_single 同样可见）', async () => {
+    mocks.prisma.shareVersion.findMany.mockResolvedValue([{ versionId: 'v1', share: openShare }])
+    await listVersions({ data: { designId: DESIGN, versionIds: ['v1'] } })
+    const arg = mocks.prisma.shareVersion.findMany.mock.calls[0][0] as { where: { share: Record<string, unknown> } }
+    expect(arg.where.share).toEqual(expect.objectContaining({ designId: DESIGN, status: 'ACTIVE' }))
+    expect(arg.where.share).not.toHaveProperty('type')
+  })
+
+  it('无密码分享 → 返回版本，且版本查询限定本 design', async () => {
+    mocks.prisma.shareVersion.findMany.mockResolvedValue([{ versionId: 'v1', share: openShare }])
+    expect(await listVersions({ data: { designId: DESIGN, versionIds: ['v1', 'v2'] } })).toEqual({
+      versions: [{ id: 'v1', versionLabel: 'v1' }],
+    })
+    expect(mocks.prisma.designVersion.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { id: { in: ['v1'] }, designId: DESIGN } }),
+    )
+  })
+
+  it('有密码分享：无凭证 → 空；持凭证 → 返回', async () => {
+    mocks.prisma.shareVersion.findMany.mockResolvedValue([{ versionId: 'v1', share: lockedShare }])
+    expect(await listVersions({ data: { designId: DESIGN, versionIds: ['v1'] } })).toEqual({ versions: [] })
+    issueShareAccess('s-locked')
+    expect(await listVersions({ data: { designId: DESIGN, versionIds: ['v1'] } })).toEqual({
+      versions: [{ id: 'v1', versionLabel: 'v1' }],
+    })
+  })
+
+  it('同一版本同时在有密码与无密码分享中 → 任一通过即可见', async () => {
+    mocks.prisma.shareVersion.findMany.mockResolvedValue([
+      { versionId: 'v1', share: lockedShare },
+      { versionId: 'v1', share: openShare },
+    ])
+    expect(await listVersions({ data: { designId: DESIGN, versionIds: ['v1'] } })).toEqual({
+      versions: [{ id: 'v1', versionLabel: 'v1' }],
+    })
+  })
+})
+
+describe('getShareVersionDataFn', () => {
+  it('有密码分享无凭证 → null，不读 pageVersions', async () => {
+    mocks.prisma.shareVersion.findMany.mockResolvedValue([{ versionId: 'v1', share: lockedShare }])
+    expect(await versionData({ data: { designId: DESIGN, versionId: 'v1' } })).toBeNull()
+    expect(mocks.prisma.designVersion.findFirst).not.toHaveBeenCalled()
+  })
+
+  it('持凭证 → 返回归一化 pageVersions（旧数组 canvas → {elements, device}）', async () => {
+    mocks.prisma.shareVersion.findMany.mockResolvedValue([{ versionId: 'v1', share: lockedShare }])
+    issueShareAccess('s-locked')
+    const result = (await versionData({ data: { designId: DESIGN, versionId: 'v1' } })) as {
+      version: { pageVersions: Array<{ canvas: unknown }> }
+    }
+    expect(result.version.pageVersions[0].canvas).toEqual({ elements: [], device: 'desktop' })
+    expect(mocks.prisma.designVersion.findFirst).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { id: 'v1', designId: DESIGN } }),
+    )
+  })
+
+  it('凭证绑定 shareId：持他 share 凭证不放行', async () => {
+    mocks.prisma.shareVersion.findMany.mockResolvedValue([{ versionId: 'v1', share: lockedShare }])
+    issueShareAccess('s-other')
+    expect(await versionData({ data: { designId: DESIGN, versionId: 'v1' } })).toBeNull()
+  })
+})

package/src/server/serverFns/design/share/__tests__/verify-password.test.ts

@@ -22,6 +22,7 @@ const mocks = vi.hoisted(() => ({
   request: new Request('https://allblue.test/share', {
     headers: { 'x-forwarded-for': '203.0.113.7' },
   }),
+  cookies: new Map<string, string>(),
   prisma: {
     designVersion: { findFirst: vi.fn() },
     share: { findFirst: vi.fn(), findMany: vi.fn() },
@@ -37,7 +38,13 @@ vi.mock('@tanstack/react-start', () => ({
     }),
   }),
 }))
-vi.mock('@tanstack/react-start/server', () => ({ getRequest: () => mocks.request }))
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: () => mocks.request,
+  getCookie: (name: string) => mocks.cookies.get(name),
+  setCookie: (name: string, value: string) => {
+    mocks.cookies.set(name, value)
+  },
+}))
 vi.mock('@allbluecn/database', () => ({ prisma: mocks.prisma }))
 vi.mock('@allbluecn/database/lib/share-utils', () => ({ verifySharePassword: mocks.verify }))
 
@@ -52,6 +59,8 @@ const payload = { designId: 'd1', password: 'guess' }
 beforeEach(() => {
   // 切到 development 才能验证限流行为（NODE_ENV=test 时限流器整体豁免）
   vi.stubEnv('NODE_ENV', 'development')
+  vi.stubEnv('AUTH_SECRET', 'test-share-access-secret')
+  mocks.cookies.clear()
   resetAuthRateLimitStoreForTest()
   mocks.prisma.designVersion.findFirst.mockResolvedValue(null)
   mocks.prisma.share.findFirst.mockResolvedValue({ id: 's1', password: 'hashed', hasPassword: true })
@@ -65,13 +74,15 @@ afterEach(() => {
 })
 
 describe('verifySharePasswordFn 限流（SEC-10）', () => {
-  it('密码正确返回 valid:true', async () => {
+  it('密码正确返回 valid:true，并签发该 share 的访问凭证 cookie', async () => {
     mocks.verify.mockResolvedValue(true)
     expect(await verifySharePasswordFn({ data: payload })).toEqual({ valid: true })
+    expect(mocks.cookies.get('share_access_s1')).toMatch(/^\d+\.[A-Za-z0-9_-]+$/)
   })
 
-  it('密码错误返回 valid:false', async () => {
+  it('密码错误返回 valid:false，且不签发凭证', async () => {
     expect(await verifySharePasswordFn({ data: payload })).toEqual({ valid: false })
+    expect(mocks.cookies.size).toBe(0)
   })
 
   it('连续失败达阈值后，即使密码正确也返回 valid:false（不泄露限流细节）', async () => {

package/src/server/serverFns/design/share/verify-password.ts

@@ -26,6 +26,7 @@ import {
   recordSharePasswordFailure,
   clearSharePasswordFailures,
 } from '@/server/middlewares/auth-rate-limit'
+import { issueShareAccess } from '@/server/design/share-access'
 
 export const verifySharePasswordFn = createServerFn({ method: 'POST' })
   .validator(z.object({
@@ -93,6 +94,9 @@ export const verifySharePasswordFn = createServerFn({ method: 'POST' })
     const valid = await verifySharePassword(password, share.password)
     if (valid) {
       clearSharePasswordFailures(ip)
+      // 签发该 share 的访问凭证（httpOnly cookie）——分享数据面以此放行，
+      // 不再信任客户端 sessionStorage 的「已验证」状态
+      issueShareAccess(share.id)
     } else {
       recordSharePasswordFailure(ip)
     }

package/src/server/serverFns/design/share/versions.ts

@@ -20,30 +20,25 @@ import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
 import type { Prisma } from '@allbluecn/database'
 import { sortSnapshotsByTree, type DesignPage } from '@/lib/design-tree-utils'
+import { resolveAccessibleVersionIds } from '@/server/design/access'
+
+// 分享数据面（公开访问，不强制登录）。版本可见性口径与 getVersionShareFn 的 SEC-18 一致：
+// 版本必须经 ShareVersion 关联到该 design 下至少一个 ACTIVE 且未过期的分享（主分享 prd 或
+// 单版本分享 prd_single 均可），且该分享通过密码门禁（shareGatePassed）。
+// 此前只查 type:'prd' 且完全不校验密码——密码门仅存在于前端，RPC 直连即可拉全量内容。
 
 export const getShareVersionsFn = createServerFn({ method: 'GET' })
   .validator(z.object({
     designId: z.string(),
-    versionIds: z.array(z.string()),
+    versionIds: z.array(z.string()).max(200),
   }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
-    const share = await prisma.share.findFirst({
-      where: { designId: data.designId, type: 'prd', status: 'ACTIVE' },
-      select: { id: true, expiresAt: true },
-    })
-    if (!share) return { versions: [] }
-    const isExpired = share.expiresAt && share.expiresAt < new Date()
-    if (isExpired) return { versions: [] }
-
-    const shareVersions = await prisma.shareVersion.findMany({
-      where: { shareId: share.id, versionId: { in: data.versionIds } },
-      select: { versionId: true },
-    })
-    const versionIds = shareVersions.map(sv => sv.versionId)
+    const versionIds = await resolveAccessibleVersionIds(data.designId, data.versionIds)
+    if (versionIds.length === 0) return { versions: [] }
 
     const versions = await prisma.designVersion.findMany({
-      where: { id: { in: versionIds } },
+      where: { id: { in: versionIds }, designId: data.designId },
       select: { id: true, versionLabel: true, notes: true, createdAt: true },
       orderBy: { createdAt: 'desc' },
     })
@@ -57,22 +52,11 @@ export const getShareVersionDataFn = createServerFn({ method: 'GET' })
   }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
-    const share = await prisma.share.findFirst({
-      where: { designId: data.designId, type: 'prd', status: 'ACTIVE' },
-      select: { id: true, expiresAt: true },
-    })
-    if (!share) return null
-    const isExpired = share.expiresAt && share.expiresAt < new Date()
-    if (isExpired) return null
-
-    const shareVersion = await prisma.shareVersion.findFirst({
-      where: { shareId: share.id, versionId: data.versionId },
-      select: { id: true },
-    })
-    if (!shareVersion) return null
+    const accessible = await resolveAccessibleVersionIds(data.designId, [data.versionId])
+    if (accessible.length === 0) return null
 
-    const version = await prisma.designVersion.findUnique({
-      where: { id: data.versionId },
+    const version = await prisma.designVersion.findFirst({
+      where: { id: data.versionId, designId: data.designId },
       select: {
         id: true,
         versionLabel: true,

package/src/server/serverFns/design/share.ts

@@ -19,6 +19,27 @@ import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
 
+// 分享门禁元数据（公开访问，不强制登录）。INACTIVE/过期分享不回显设计元数据
+// （审计 2026-10-25 🟡：知道 designId 即可读 name/icon/description 的低危泄露），
+// 仅返回客户端渲染「分享已关闭」所需的最小字段。
+
+interface ShareGateDTO {
+  id: string
+  hasPassword: boolean
+  versionIds: string[]
+  design: { id: string; name: string; icon: string | null; description: string | null }
+}
+
+interface ShareGateResult {
+  error?: 'not_found'
+  designId: string
+  share: ShareGateDTO | null
+  hasPassword: boolean
+  isActive: boolean
+  versionLabel: string | null
+  shareNotFound: boolean
+}
+
 const shareInput = z.object({
   designId: z.string(),
   from: z.string().optional(),
@@ -109,14 +130,38 @@ export const getDesignShareFn = createServerFn({ method: 'GET' })
       }
     }
 
-    if (!share && !shareNotFound) return { error: 'not_found' as const }
+    if (!share && !shareNotFound) {
+      const notFound: ShareGateResult = {
+        error: 'not_found',
+        designId,
+        share: null,
+        hasPassword: false,
+        isActive: false,
+        versionLabel: null,
+        shareNotFound: false,
+      }
+      return notFound
+    }
+
+    const shareActive = share
+      ? share.status === 'ACTIVE' && (!share.expiresAt || share.expiresAt > new Date())
+      : false
 
-    return {
+    const result: ShareGateResult = {
       designId,
-      share: share ? { ...share, password: undefined, versionIds: share.shareVersions?.map(sv => sv.versionId) ?? [] } : null,
+      // 停用/过期分享收敛为 null：客户端据此渲染「分享已关闭」，不消费设计元数据
+      share: share && shareActive
+        ? {
+            id: share.id,
+            hasPassword: share.hasPassword,
+            versionIds: share.shareVersions?.map(sv => sv.versionId) ?? [],
+            design: share.design,
+          }
+        : null,
       hasPassword: share?.hasPassword ?? false,
-      isActive: share ? (share.status === 'ACTIVE' && (!share.expiresAt || share.expiresAt > new Date())) : false,
+      isActive: shareActive,
       versionLabel,
       shareNotFound,
-    } as any
+    }
+    return result
   })