@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/design/shares-password.ts

@@ -19,13 +19,12 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
+import type { Prisma } from '@allbluecn/database'
 import { getServerSeam } from '@allbluecn/kernel'
-import { customAlphabet } from 'nanoid'
 import { notifyClients } from '@/lib/share-events'
 import { verifyDesignOwner } from '@allbluecn/database/lib/share-utils'
-
-const PASSWORD_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
-const generatePassword = customAlphabet(PASSWORD_ALPHABET, 4)
+import { sessionUserId } from '@/server/design/access'
+import { generateSharePassword, hashSharePassword } from '@/server/design/share-generate'
 
 export const setDesignSharePasswordFn = createServerFn({ method: 'POST' })
   .validator(z.object({ designId: z.string() }))
@@ -35,7 +34,7 @@ export const setDesignSharePasswordFn = createServerFn({ method: 'POST' })
     const session = await getServerSeam().requireAuth(request)
     const { designId } = data
 
-    if (!(await verifyDesignOwner(designId, session.user!.id!))) {
+    if (!(await verifyDesignOwner(designId, sessionUserId(session)))) {
       throw new Error("无权限")
     }
 
@@ -46,12 +45,13 @@ export const setDesignSharePasswordFn = createServerFn({ method: 'POST' })
 
     if (!share) throw new Error("Share not found")
 
-    const newPassword = generatePassword()
+    const newPassword = generateSharePassword()
 
     await prisma.share.update({
       where: { id: share.id },
       data: {
-        password: newPassword,
+        // hash-on-write：DB 只存 bcrypt 哈希，明文仅本次响应一次性回显属主
+        password: await hashSharePassword(newPassword),
         hasPassword: true,
         updatedAt: new Date(),
       },
@@ -62,6 +62,8 @@ export const setDesignSharePasswordFn = createServerFn({ method: 'POST' })
     return { password: newPassword }
   })
 
+// 关闭密码仅置 hasPassword=false、password 列保留旧值（重开沿用旧密码）——
+// 有意设计：shareGatePassed 以 hasPassword 为权威开关（见 @/server/design/share-access）
 export const toggleDesignSharePasswordFn = createServerFn({ method: 'POST' })
   .validator(z.object({ designId: z.string(), enabled: z.boolean() }))
   .handler(async ({ data }) => {
@@ -70,7 +72,7 @@ export const toggleDesignSharePasswordFn = createServerFn({ method: 'POST' })
     const session = await getServerSeam().requireAuth(request)
     const { designId, enabled } = data
 
-    if (!(await verifyDesignOwner(designId, session.user!.id!))) {
+    if (!(await verifyDesignOwner(designId, sessionUserId(session)))) {
       throw new Error("无权限")
     }
 
@@ -81,13 +83,17 @@ export const toggleDesignSharePasswordFn = createServerFn({ method: 'POST' })
 
     if (!share) throw new Error("Share not found")
 
-    const updateData: any = {
+    const updateData: Prisma.ShareUpdateInput = {
       hasPassword: enabled,
       updatedAt: new Date(),
     }
 
+    // 开启且无存量密码时生成新密码：DB 存哈希，明文仅本次响应一次性回显属主；
+    // 沿用存量密码时无法回显明文（哈希不可逆），属主如需查看走「重新生成」
+    let generatedPlain: string | null = null
     if (enabled && !share.password) {
-      updateData.password = generatePassword()
+      generatedPlain = generateSharePassword()
+      updateData.password = await hashSharePassword(generatedPlain)
     }
 
     const updated = await prisma.share.update({
@@ -98,7 +104,7 @@ export const toggleDesignSharePasswordFn = createServerFn({ method: 'POST' })
     notifyClients(designId, "password_changed", { hasPassword: enabled, shareId: share.id })
 
     return {
-      password: updated.password,
+      password: generatedPlain,
       hasPassword: updated.hasPassword,
     }
   })
@@ -120,16 +126,17 @@ export const setDesignSingleSharePasswordFn = createServerFn({ method: 'POST' })
       throw new Error("Share not found")
     }
     // IDOR 封堵：share 行本身不携带属主，经关联 design 校验当前用户
-    if (!(await verifyDesignOwner(share.designId, session.user!.id!))) {
+    if (!(await verifyDesignOwner(share.designId, sessionUserId(session)))) {
       throw new Error("无权限")
     }
 
-    const newPassword = generatePassword()
+    const newPassword = generateSharePassword()
 
     await prisma.share.update({
       where: { id: shareId },
       data: {
-        password: newPassword,
+        // hash-on-write：DB 只存 bcrypt 哈希，明文仅本次响应一次性回显属主
+        password: await hashSharePassword(newPassword),
         hasPassword: true,
         updatedAt: new Date(),
       },
@@ -165,17 +172,20 @@ export const toggleDesignSingleSharePasswordFn = createServerFn({ method: 'POST'
       throw new Error("Share not found")
     }
     // IDOR 封堵：share 行本身不携带属主，经关联 design 校验当前用户
-    if (!(await verifyDesignOwner(share.designId, session.user!.id!))) {
+    if (!(await verifyDesignOwner(share.designId, sessionUserId(session)))) {
       throw new Error("无权限")
     }
 
-    const updateData: any = {
+    const updateData: Prisma.ShareUpdateInput = {
       hasPassword: enabled,
       updatedAt: new Date(),
     }
 
+    // 开启且无存量密码时生成新密码：DB 存哈希，明文仅本次响应一次性回显属主（同主分享 toggle 口径）
+    let generatedPlain: string | null = null
     if (enabled && !share.password) {
-      updateData.password = generatePassword()
+      generatedPlain = generateSharePassword()
+      updateData.password = await hashSharePassword(generatedPlain)
     }
 
     const updatedShare = await prisma.share.update({
@@ -194,7 +204,7 @@ export const toggleDesignSingleSharePasswordFn = createServerFn({ method: 'POST'
     })
 
     return {
-      password: updatedShare.password,
+      password: generatedPlain,
       hasPassword: updatedShare.hasPassword,
       enabled: updatedShare.status === "ACTIVE",
     }

package/src/server/serverFns/design/shares.ts

@@ -19,22 +19,12 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
+import type { Prisma } from '@allbluecn/database'
 import { getServerSeam } from '@allbluecn/kernel'
-import { customAlphabet } from 'nanoid'
 import { notifyClients } from '@/lib/share-events'
 import { verifyDesignOwner } from '@allbluecn/database/lib/share-utils'
-
-const TOKEN_ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
-const generateToken = customAlphabet(TOKEN_ALPHABET, 24)
-
-const PASSWORD_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
-const generatePassword = customAlphabet(PASSWORD_ALPHABET, 4)
-
-const EXPIRY_DAYS: Record<string, number> = {
-  "7": 7,
-  "30": 30,
-  "90": 90,
-}
+import { sessionUserId } from '@/server/design/access'
+import { EXPIRY_DAYS, generateSharePassword, generateShareToken, hashSharePassword } from '@/server/design/share-generate'
 
 export const listDesignSharesFn = createServerFn({ method: 'GET' })
   .validator(z.object({ designId: z.string() }))
@@ -43,7 +33,7 @@ export const listDesignSharesFn = createServerFn({ method: 'GET' })
     const request = getRequest()
     const session = await getServerSeam().requireAuth(request)
 
-    if (!(await verifyDesignOwner(data.designId, session.user!.id!))) {
+    if (!(await verifyDesignOwner(data.designId, sessionUserId(session)))) {
       throw new Error("无权限")
     }
 
@@ -54,15 +44,17 @@ export const listDesignSharesFn = createServerFn({ method: 'GET' })
     if (!share) return null
     return {
       ...share,
+      // 密码哈希化后列里只有 bcrypt 哈希，任何读路径都不回传（属主亦然，明文仅生成/重置时一次性回显）
+      password: undefined,
       versionIds: share.shareVersions?.map(sv => sv.versionId) ?? [],
-    } as any
+    }
   })
 
 export const createDesignShareFn = createServerFn({ method: 'POST' })
   .validator(z.object({
     designId: z.string(),
     enabled: z.boolean().optional(),
-    password: z.string().optional().nullable(),
+    password: z.string().max(128).optional().nullable(),
     versionIds: z.array(z.string()).optional(),
     expiryDays: z.string().optional(),
   }))
@@ -72,7 +64,7 @@ export const createDesignShareFn = createServerFn({ method: 'POST' })
     const session = await getServerSeam().requireAuth(request)
     const { designId, enabled, password, versionIds, expiryDays } = data
 
-    if (!(await verifyDesignOwner(designId, session.user!.id!))) {
+    if (!(await verifyDesignOwner(designId, sessionUserId(session)))) {
       throw new Error("无权限")
     }
 
@@ -107,8 +99,9 @@ export const createDesignShareFn = createServerFn({ method: 'POST' })
       ? new Date(Date.now() + EXPIRY_DAYS[expiryDays] * 86400000)
       : new Date(Date.now() + 7 * 86400000)
 
-    const rawPassword = password === undefined || password === null
-      ? generatePassword()
+    // 空串统一按「自动生成」处理（与 prd_single 口径一致；hasPassword 语义由 !!rawPassword 派生）
+    const rawPassword = password === undefined || password === null || password === ""
+      ? generateSharePassword()
       : password
 
     if (existing) {
@@ -116,7 +109,8 @@ export const createDesignShareFn = createServerFn({ method: 'POST' })
         where: { id: existing.id },
         data: {
           status: "ACTIVE",
-          password: rawPassword,
+          // hash-on-write：DB 只存 bcrypt 哈希；明文仅随本次响应一次性回显属主
+          password: await hashSharePassword(rawPassword),
           hasPassword: !!rawPassword,
           expiresAt,
           token: existing.token,
@@ -129,7 +123,8 @@ export const createDesignShareFn = createServerFn({ method: 'POST' })
           data: versionIds.map((vid: string) => ({ shareId: existing.id, versionId: vid })),
         })
       }
-      return { ...updated, password: rawPassword } as any
+      // 明文密码仅此一次随响应回显给属主（面板复制/展示用）
+      return { ...updated, password: rawPassword }
     }
 
     const created = await prisma.share.create({
@@ -137,8 +132,8 @@ export const createDesignShareFn = createServerFn({ method: 'POST' })
         designId,
         type: "prd",
         status: "ACTIVE",
-        token: generateToken(),
-        password: rawPassword,
+        token: generateShareToken(),
+        password: await hashSharePassword(rawPassword),
         hasPassword: !!rawPassword,
         expiresAt,
       },
@@ -148,7 +143,7 @@ export const createDesignShareFn = createServerFn({ method: 'POST' })
         data: versionIds.map((vid: string) => ({ shareId: created.id, versionId: vid })),
       })
     }
-    return { ...created, password: rawPassword } as any
+    return { ...created, password: rawPassword }
   })
 
 export const listDesignSingleSharesFn = createServerFn({ method: 'GET' })
@@ -163,7 +158,7 @@ export const listDesignSingleSharesFn = createServerFn({ method: 'GET' })
     const session = await getServerSeam().requireAuth(request)
     const { designId, page, pageSize } = data
 
-    if (!(await verifyDesignOwner(designId, session.user!.id!))) {
+    if (!(await verifyDesignOwner(designId, sessionUserId(session)))) {
       throw new Error("无权限")
     }
 
@@ -190,10 +185,12 @@ export const listDesignSingleSharesFn = createServerFn({ method: 'GET' })
     })
     const versionMap = new Map(versions.map(v => [v.id, v]))
 
-    const result = (shares as any[]).map(share => {
+    const result = shares.map(share => {
       const versionId = share.shareVersions[0]?.versionId
       return {
         ...share,
+        // 密码哈希化后不回传（见 getDesignShareFn 注）
+        password: undefined,
         version: versionId ? (versionMap.get(versionId) ?? null) : null,
       }
     })
@@ -205,7 +202,7 @@ export const createDesignSingleShareFn = createServerFn({ method: 'POST' })
   .validator(z.object({
     designId: z.string(),
     versionId: z.string(),
-    password: z.string().optional().nullable(),
+    password: z.string().max(128).optional().nullable(),
     expiryDays: z.string().optional(),
   }))
   .handler(async ({ data }) => {
@@ -214,7 +211,7 @@ export const createDesignSingleShareFn = createServerFn({ method: 'POST' })
     const session = await getServerSeam().requireAuth(request)
     const { designId, versionId, password, expiryDays } = data
 
-    if (!(await verifyDesignOwner(designId, session.user!.id!))) {
+    if (!(await verifyDesignOwner(designId, sessionUserId(session)))) {
       throw new Error("无权限")
     }
 
@@ -227,7 +224,7 @@ export const createDesignSingleShareFn = createServerFn({ method: 'POST' })
       include: { shareVersions: { select: { versionId: true } } },
     })
     if (existing) {
-      return { ...existing, password: undefined, alreadyExists: true } as any
+      return { ...existing, password: undefined, alreadyExists: true }
     }
 
     const expiresAt = expiryDays && EXPIRY_DAYS[expiryDays]
@@ -235,7 +232,7 @@ export const createDesignSingleShareFn = createServerFn({ method: 'POST' })
       : new Date(Date.now() + 7 * 86400000)
 
     const rawPassword = password === undefined || password === null || password === ""
-      ? generatePassword()
+      ? generateSharePassword()
       : password
 
     const created = await prisma.share.create({
@@ -243,8 +240,8 @@ export const createDesignSingleShareFn = createServerFn({ method: 'POST' })
         designId,
         type: "prd_single",
         status: "ACTIVE",
-        token: generateToken(),
-        password: rawPassword,
+        token: generateShareToken(),
+        password: await hashSharePassword(rawPassword),
         hasPassword: !!rawPassword,
         expiresAt,
         shareVersions: { create: [{ versionId }] },
@@ -253,7 +250,7 @@ export const createDesignSingleShareFn = createServerFn({ method: 'POST' })
     })
 
     notifyClients(designId, "single_share_created", { versionId })
-    return { ...created, password: rawPassword } as any
+    return { ...created, password: rawPassword }
   })
 
 export const getDesignSingleShareFn = createServerFn({ method: 'GET' })
@@ -269,10 +266,11 @@ export const getDesignSingleShareFn = createServerFn({ method: 'GET' })
       throw new Error("Share not found")
     }
     // IDOR 封堵：share 行本身不携带属主，经关联 design 校验当前用户
-    if (!(await verifyDesignOwner(share.designId, session.user!.id!))) {
+    if (!(await verifyDesignOwner(share.designId, sessionUserId(session)))) {
       throw new Error("无权限")
     }
-    return share as any
+    // 密码哈希化后不回传（见 getDesignShareFn 注）
+    return { ...share, password: undefined }
   })
 
 export const updateDesignSingleShareFn = createServerFn({ method: 'POST' })
@@ -296,11 +294,11 @@ export const updateDesignSingleShareFn = createServerFn({ method: 'POST' })
       throw new Error("Share not found")
     }
     // IDOR 封堵：share 行本身不携带属主，经关联 design 校验当前用户
-    if (!(await verifyDesignOwner(share.designId, session.user!.id!))) {
+    if (!(await verifyDesignOwner(share.designId, sessionUserId(session)))) {
       throw new Error("无权限")
     }
 
-    const updateData: any = {}
+    const updateData: Prisma.ShareUpdateInput = {}
 
     if (enabled !== undefined) {
       updateData.status = enabled ? "ACTIVE" : "DISABLED"
@@ -337,7 +335,8 @@ export const updateDesignSingleShareFn = createServerFn({ method: 'POST' })
       }
     }
 
-    return updatedShare as any
+    // 密码哈希化后不回传（见 getDesignShareFn 注）
+    return { ...updatedShare, password: undefined }
   })
 
 export const deleteDesignSingleShareFn = createServerFn({ method: 'POST' })
@@ -357,7 +356,7 @@ export const deleteDesignSingleShareFn = createServerFn({ method: 'POST' })
       throw new Error("Share not found")
     }
     // IDOR 封堵：share 行本身不携带属主，经关联 design 校验当前用户
-    if (!(await verifyDesignOwner(share.designId, session.user!.id!))) {
+    if (!(await verifyDesignOwner(share.designId, sessionUserId(session)))) {
       throw new Error("无权限")
     }
 

package/src/server/serverFns/design/versions.ts

@@ -20,7 +20,7 @@ import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { getPrisma } from '@allbluecn/database/get-prisma'
 import { getServerSeam } from '@allbluecn/kernel'
-import { verifyDesignOwner } from '@allbluecn/database/lib/share-utils'
+import { assertDesignOwner, sessionUserId } from '@/server/design/access'
 import { sortSnapshotsByTree, type DesignPage } from '@/lib/design-tree-utils'
 
 export const listDesignVersionsFn = createServerFn({ method: 'GET' })
@@ -31,11 +31,8 @@ export const listDesignVersionsFn = createServerFn({ method: 'GET' })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-
-    if (!(await verifyDesignOwner(data.designId, session.user!.id!))) {
-      throw new Error("无权限")
-    }
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
+    await assertDesignOwner(data.designId, userId)
 
     const versions = await prisma.designVersion.findMany({
       where: { designId: data.designId },
@@ -65,64 +62,25 @@ export const listDesignVersionsFn = createServerFn({ method: 'GET' })
     return versions
   })
 
+// 仅发布版本：原 restore 分支（restorePageId/restoreVersionId/pageVersion 入参）无任何客户端
+// 调用方（页面还原走 executeRestoreVersion → updateDesignPageFn + createDesignPageVersionFn），
+// 且允许以自传 JSON 覆盖任意 pageId 的 canvas/content（审计 2026-10-25 🔴），整段移除。
 export const createDesignVersionFn = createServerFn({ method: 'POST' })
   .validator(z.object({
-    designId: z.string().optional(),
-    restorePageId: z.string().optional(),
-    restoreVersionId: z.string().optional(),
-    pageVersion: z.any().optional(),
-    major: z.number().int().optional(),
-    minor: z.number().int().optional(),
-    patch: z.number().int().optional(),
+    designId: z.string(),
+    major: z.number().int().min(0),
+    minor: z.number().int().min(0),
+    patch: z.number().int().min(0),
     notes: z.string().optional(),
-    pageIds: z.array(z.string()).optional(),
+    pageIds: z.array(z.string()),
     selectedPageVersions: z.record(z.string(), z.number().int()).optional(),
   }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const session = await getServerSeam().requireAuth(request)
-
-    if (data.restorePageId && (data.restoreVersionId || data.pageVersion)) {
-      let canvas: any = null
-      let content: any = null
-      let targetVersionLabel: string | null = null
-
-      if (data.pageVersion) {
-        canvas = data.pageVersion.canvas
-        content = data.pageVersion.content
-        targetVersionLabel = `v${data.pageVersion.version}`
-      } else if (data.restoreVersionId) {
-        const designVersion = await prisma.designVersion.findUnique({ where: { id: data.restoreVersionId }, select: { versionLabel: true, pageVersions: true } })
-        if (!designVersion) throw new Error('Version not found')
-
-        targetVersionLabel = designVersion.versionLabel
-        const pageVersions = designVersion.pageVersions as any[]
-        const snapshot = pageVersions.find((pv: any) => pv.pageId === data.restorePageId)
-        if (!snapshot) throw new Error('Page not found in version')
-
-        if (snapshot.pageVersionId) {
-          const pv = await prisma.pageVersion.findUnique({ where: { id: snapshot.pageVersionId }, select: { canvas: true, content: true } })
-          canvas = pv?.canvas ?? null
-          content = pv?.content ?? null
-        } else {
-          canvas = snapshot.canvas
-          content = snapshot.content
-        }
-      }
-
-      await prisma.designPage.update({
-        where: { id: data.restorePageId },
-        data: { canvas, content },
-      })
-
-      return { success: true, message: `Page restored to ${targetVersionLabel}` }
-    }
-
+    const userId = sessionUserId(await getServerSeam().requireAuth(request))
     const { designId, major, minor, patch, notes, pageIds, selectedPageVersions } = data
-    if (!designId || major === undefined || minor === undefined || patch === undefined || !pageIds) {
-      throw new Error('designId, major, minor, patch, pageIds required')
-    }
+    await assertDesignOwner(designId, userId)
 
     const versionLabel = `v${major}.${minor}.${patch}`
 
@@ -279,7 +237,7 @@ export const createDesignVersionFn = createServerFn({ method: 'POST' })
           versionLabel,
           pageVersions: allPageVersions,
           notes: notes || null,
-          userId: session.user!.id!,
+          userId,
         },
       })
       return version

package/src/server/serverFns/harness/__tests__/attach-to-kb.spec.ts

@@ -9,7 +9,6 @@ const mocks = vi.hoisted(() => ({
   kb: vi.fn(),
   docAggregate: vi.fn(),
   docCreate: vi.fn(),
-  docUpdate: vi.fn(),
   runUpdate: vi.fn(),
   indexDoc: vi.fn(),
 }))
@@ -21,7 +20,7 @@ vi.mock("@allbluecn/database", () => ({
   prisma: {
     generationRun: { findFirst: mocks.run, update: mocks.runUpdate },
     knowledgeBase: { findFirst: mocks.kb },
-    knowledgeDocument: { aggregate: mocks.docAggregate, create: mocks.docCreate, update: mocks.docUpdate },
+    knowledgeDocument: { aggregate: mocks.docAggregate, create: mocks.docCreate },
   },
 }))
 vi.mock("@/server/ai-gateway/knowledge-index-core", () => ({ indexDocumentById: mocks.indexDoc }))
@@ -40,19 +39,20 @@ beforeEach(() => {
   mocks.kb.mockResolvedValue({ id: "kb-1" })
   mocks.docAggregate.mockResolvedValue({ _max: { sortOrder: 3 } })
   mocks.docCreate.mockResolvedValue({ id: "doc-1", title: "T" })
-  mocks.docUpdate.mockResolvedValue({ id: "doc-1" })
   mocks.runUpdate.mockResolvedValue(RUN_TEXT)
   mocks.indexDoc.mockResolvedValue({ indexed: 1 })
 })
 
-it("本人回流：三步写入（create 骨架 → update content → 索引）+ linkedTarget", async () => {
+it("本人回流：单次 create 即含正文（无孤儿文档窗口）→ 索引 + linkedTarget", async () => {
   const res = await attachToKbFn({ data: { generationRunId: "run-1", kbId: "kb-1", title: "转写稿" } })
   expect(mocks.docCreate).toHaveBeenCalledWith(expect.objectContaining({
-    data: expect.objectContaining({ kbId: "kb-1", title: "转写稿", type: "doc", sortOrder: 4 }),
-  }))
-  expect(mocks.docUpdate).toHaveBeenCalledWith(expect.objectContaining({
-    where: { id: "doc-1" },
-    data: expect.objectContaining({ content: { markdown: "会议记录全文" } }),
+    data: expect.objectContaining({
+      kbId: "kb-1",
+      title: "转写稿",
+      type: "doc",
+      sortOrder: 4,
+      content: { markdown: "会议记录全文" },
+    }),
   }))
   expect(mocks.indexDoc).toHaveBeenCalledWith("doc-1")
   expect(mocks.runUpdate).toHaveBeenCalledWith({ where: { id: "run-1" }, data: { linkedTarget: { kind: "kb", targetId: "kb-1", at: expect.any(String) } } })

package/src/server/serverFns/harness/__tests__/attach-to-story.spec.ts

@@ -97,8 +97,9 @@ it("守卫拒绝（私网/mapped artifact URL）→ 不发 fetch 不建附件（
   expect(fetchMock.mock.calls.length).toBe(0)
 })
 
-it("fetch 以 redirect:'error' 发起（SEC-12 防 302 跳私网）", async () => {
+it("fetch 以 redirect:'error' + 超时信号发起（SEC-12 防 302 跳私网 / 慢速源挂起）", async () => {
   await attachToStoryFn({ data: { generationRunId: "run-1", storyId: "st-1" } })
   const [, init] = (globalThis.fetch as unknown as ReturnType<typeof vi.fn>).mock.calls[0] as [string, RequestInit]
   expect(init).toMatchObject({ redirect: "error" })
+  expect(init.signal).toBeInstanceOf(AbortSignal)
 })

package/src/server/serverFns/harness/__tests__/extract-attachment.spec.ts

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+
+/**
+ * extractAttachmentFn 鉴权接线回归（审计 2026-10-25 🟠：echo 型 stub 无鉴权违反
+ * 「serverFn 首行自查鉴权」约定——占位实现也必须有认证门，防止接入真实解析
+ * 管线时延续无鉴权入口）。
+ */
+import { beforeEach, describe, expect, it, vi } from "vitest"
+import type { ZodType } from "zod"
+
+const mocks = vi.hoisted(() => ({
+  request: new Request("https://allblue.test/extract-attachment"),
+  auth: vi.fn(),
+}))
+vi.mock("@tanstack/react-start", () => ({ createServerFn: () => ({ validator: (schema: ZodType) => ({ handler: (fn: (args: { data: unknown }) => unknown) => async (args: { data: unknown }) => fn({ data: schema.parse(args.data) }) }) }) }))
+vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => mocks.request }))
+vi.mock("@/server/auth-helpers", () => ({ requireAuth: mocks.auth }))
+
+import { extractAttachmentFn } from "../extract-attachment"
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.auth.mockResolvedValue({ user: { id: "u1" } })
+})
+
+describe("extractAttachmentFn", () => {
+  it("未登录 → requireAuth 抛错，不回显内容", async () => {
+    mocks.auth.mockRejectedValueOnce(new Error("UNAUTHORIZED"))
+    await expect(
+      extractAttachmentFn({ data: { text: "secret", filename: "a.txt" } }),
+    ).rejects.toThrow("UNAUTHORIZED")
+  })
+
+  it("登录 → 截断回显 500 字符上限", async () => {
+    const res = await extractAttachmentFn({ data: { text: "x".repeat(501), filename: "a.txt" } })
+    expect(res).toEqual({ extracted: "x".repeat(500), filename: "a.txt" })
+  })
+})