@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/harness/__tests__/github-workspace.spec.ts

@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+
+/**
+ * github-workspace 输入收敛与超时回归（审计 2026-10-25 🟡）：
+ * - owner/repo 字符白名单（^[\w.-]+$），`../`、`?`、`#` 无法改写固定 API URL；
+ * - saveGithubTokenFn token 上限 255；
+ * - GitHub API fetch 必带超时信号；网络异常 console.warn 后仍返回空数组（不抛）。
+ */
+import { beforeEach, describe, expect, it, vi } from "vitest"
+import type { ZodType } from "zod"
+
+const mocks = vi.hoisted(() => ({
+  request: new Request("https://allblue.test/github"),
+  session: vi.fn(),
+  fetchMock: vi.fn(),
+}))
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: () => {
+    // 链式可省略 validator（listGithubReposFn 无 validator），两段挂同一 api 对象
+    const api: any = {
+      validator(schema: ZodType) {
+        api._validator = schema
+        return api
+      },
+      handler(fn: (args: { data: unknown }) => unknown) {
+        return async (args: { data: unknown }) => {
+          let data = args?.data
+          if (api._validator && data !== undefined) data = api._validator.parse(data)
+          return fn({ data })
+        }
+      },
+    }
+    return api
+  },
+}))
+vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => mocks.request }))
+vi.mock("@/lib/session", () => ({ getCurrentSession: mocks.session }))
+vi.mock("@/server/lib/api-key-cipher", () => ({
+  encryptApiKey: (t: string) => `enc:${t}`,
+  decryptApiKey: (t: string) => t.replace(/^enc:/, ""),
+}))
+vi.mock("@allbluecn/database", () => ({
+  prisma: {
+    aiProviderConfig: { findFirst: vi.fn(), upsert: vi.fn(), deleteMany: vi.fn() },
+    account: { findFirst: vi.fn() },
+  },
+}))
+
+import { listGithubBranchesFn, listGithubReposFn, saveGithubTokenFn } from "../github-workspace"
+
+const call = (fn: unknown, data: Record<string, unknown>) =>
+  (fn as (args: unknown) => Promise<unknown>)({ data })
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.session.mockResolvedValue({ user: { id: "u1" } })
+  vi.stubGlobal("fetch", mocks.fetchMock)
+})
+
+describe("owner/repo 白名单", () => {
+  it.each([
+    ["../..", "repo"],
+    ["own?er", "repo"],
+    ["owner", "re#po"],
+    ["own er", "repo"],
+  ])("非法 owner/repo %s/%s → validator 拒绝且不发 fetch", async (owner, repo) => {
+    await expect(call(listGithubBranchesFn, { owner, repo })).rejects.toThrow()
+    expect(mocks.fetchMock).not.toHaveBeenCalled()
+  })
+
+  it("合法 owner/repo → 发起带超时信号的分支请求", async () => {
+    vi.mocked((await import("@allbluecn/database")).prisma.aiProviderConfig.findFirst).mockResolvedValue({
+      apiKey: "enc:tok",
+    } as never)
+    mocks.fetchMock.mockResolvedValue(new Response(JSON.stringify([]), { status: 200 }))
+
+    await call(listGithubBranchesFn, { owner: "all-blue", repo: "app.git_1" })
+
+    const [, init] = mocks.fetchMock.mock.calls[0] as [string, RequestInit]
+    expect(init.signal).toBeInstanceOf(AbortSignal)
+    expect(mocks.fetchMock.mock.calls[0][0]).toBe("https://api.github.com/repos/all-blue/app.git_1/branches?per_page=100")
+  })
+})
+
+describe("saveGithubTokenFn token 上限", () => {
+  it("超 255 字符 → validator 拒绝", async () => {
+    await expect(call(saveGithubTokenFn, { token: "t".repeat(256) })).rejects.toThrow()
+  })
+})
+
+describe("fetch 异常降级", () => {
+  it("网络异常 → console.warn + 返回空列表（与未连接同型，不抛错）", async () => {
+    vi.mocked((await import("@allbluecn/database")).prisma.aiProviderConfig.findFirst).mockResolvedValue({
+      apiKey: "enc:tok",
+    } as never)
+    mocks.fetchMock.mockRejectedValue(new Error("network down"))
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {})
+    try {
+      await expect(call(listGithubReposFn, {})).resolves.toEqual({ repos: [] })
+      expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining("network down"))
+    } finally {
+      warnSpy.mockRestore()
+    }
+  })
+})

package/src/server/serverFns/harness/attach-prototype.ts

@@ -31,15 +31,15 @@ export const attachPrototypeToDesignFn = createServerFn({ method: "POST" })
     const request = getRequest()
     await requireFeature(request, "mediaGeneration")
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
 
     const run = await assertRunOwnership(data.generationRunId, userId)
     await assertDesignOwnership(data.designId, userId)
 
-  const proto = sceneDocumentSchema.safeParse((run.result as { scene?: unknown } | null)?.scene)
-  if (!proto.success) throw new Error("Generation run has no prototype scene")
-  // 清洗 undefined 键（zod .optional() 保留 undefined），避免静默存 null 进 JSON 字段
-  const canvas = JSON.parse(JSON.stringify(proto.data))
+    const proto = sceneDocumentSchema.safeParse((run.result as { scene?: unknown } | null)?.scene)
+    if (!proto.success) throw new Error("Generation run has no prototype scene")
+    // 清洗 undefined 键（zod .optional() 保留 undefined），避免静默存 null 进 JSON 字段
+    const canvas = JSON.parse(JSON.stringify(proto.data))
 
     const page = await prisma.designPage.findFirst({
       where: { designId: data.designId },

package/src/server/serverFns/harness/attach-to-kb.ts

@@ -12,10 +12,10 @@ import { indexDocumentById } from "@/server/ai-gateway/knowledge-index-core"
 import { assertKbOwnership, assertRunOwnership } from "@/server/harness/attach-guards"
 
 /**
- * 回流→KB 文档（P4d，spec §3.2）。三步写入：create 骨架（对齐 createDocumentFn 语义）
- * → update content（生成物正文）→ indexDocumentById 向量索引（fire-and-forget，对齐
- * knowledge.ts:325-333 的容错语义）。投毒防护在检索侧 buildGuardedKbContext（既有），
- * 写侧无围栏。成功后写 GenerationRun.linkedTarget（覆盖）。
+ * 回流→KB 文档（P4d，spec §3.2）。create 即含正文（单次写入，避免先建骨架后
+ * update 失败留下无正文孤儿文档）→ indexDocumentById 向量索引（fire-and-forget，
+ * 对齐 knowledge.ts:325-333 的容错语义）。投毒防护在检索侧 buildGuardedKbContext
+ * （既有），写侧无围栏。成功后写 GenerationRun.linkedTarget（覆盖）。
  */
 
 const AttachToKbSchema = z.object({
@@ -41,7 +41,7 @@ export const attachToKbFn = createServerFn({ method: "POST" })
     const request = getRequest()
     await requireFeature(request, "mediaGeneration")
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
 
     const run = await assertRunOwnership(data.generationRunId, userId)
     await assertKbOwnership(data.kbId, userId)
@@ -61,14 +61,11 @@ export const attachToKbFn = createServerFn({ method: "POST" })
         type: "doc",
         sortOrder: (maxSort._max.sortOrder ?? -1) + 1,
         properties: {},
+        content: { markdown: text },
         createdBy: userId,
       },
       select: { id: true },
     })
-    await prisma.knowledgeDocument.update({
-      where: { id: doc.id },
-      data: { content: { markdown: text } },
-    })
 
     // fire-and-forget：索引失败不阻塞回流（对齐 knowledge.ts:325-333），不能静默
     void indexDocumentById(doc.id).catch((e: unknown) => {

package/src/server/serverFns/harness/attach-to-story.ts

@@ -33,7 +33,7 @@ export const attachToStoryFn = createServerFn({ method: "POST" })
     const request = getRequest()
     await requireFeature(request, "mediaGeneration")
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
 
     const run = await assertRunOwnership(data.generationRunId, userId)
     await assertStoryOwnership(data.storyId, userId)
@@ -48,8 +48,8 @@ export const attachToStoryFn = createServerFn({ method: "POST" })
 
     assertFetchableUrl(artifact.url)
     // SEC-12：redirect:error 防 302 跳私网（守卫只校验首跳目标，默认 follow 会被
-    // 重定向绕过；正确示范同 ai-gateway/media/index.ts）
-    const resp = await fetch(artifact.url, { redirect: "error" })
+    // 重定向绕过；正确示范同 ai-gateway/media/index.ts）；超时防慢速源挂起请求
+    const resp = await fetch(artifact.url, { redirect: "error", signal: AbortSignal.timeout(30_000) })
     if (!resp.ok) throw new Error(`Failed to download artifact: HTTP ${resp.status}`)
     const contentLength = Number(resp.headers.get("content-length") ?? 0)
     if (contentLength > MAX_ARTIFACT_BYTES) throw new Error("Artifact too large")

package/src/server/serverFns/harness/extract-attachment.ts

@@ -16,13 +16,18 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from "@tanstack/react-start"
+import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
+import { requireAuth } from "@/server/auth-helpers"
 
 const extractAttachmentSchema = z.object({
   text: z.string().min(1),
   filename: z.string().min(1),
 })
 
+/** 截断上限（占位实现的回显边界，接入真实解析管线时复用） */
+const EXTRACT_PREVIEW_MAX_CHARS = 500
+
 /**
  * 提取附件文本内容（占位实现）。
  *
@@ -32,9 +37,12 @@ const extractAttachmentSchema = z.object({
 export const extractAttachmentFn = createServerFn({ method: "POST" })
   .validator(extractAttachmentSchema)
   .handler(async ({ data }) => {
+    // serverFn 首行自查鉴权（审计 2026-10-25 🟠）：当前虽为 echo 型 stub 无数据访问面，
+    // 但 TODO 接入真实解析管线后若延续无鉴权即成未鉴权入口，先补齐约定
+    await requireAuth(getRequest())
     // TODO: 接入真实解析管线（如 mammoth、pdf-parse、markdown-it）
     return {
-      extracted: data.text.slice(0, 500),
+      extracted: data.text.slice(0, EXTRACT_PREVIEW_MAX_CHARS),
       filename: data.filename,
     }
   })

package/src/server/serverFns/harness/gallery.ts

@@ -143,6 +143,8 @@ export const listGenerationRunsFn = createServerFn({ method: "GET" })
 const CreateVariantSchema = z.object({
   sourceRunId: z.string().min(1),
   prompt: z.string().trim().min(1).optional(),
+  // referenceImage 为用户可控 URL，服务端会在媒体管线（imageDataUrl）本地 fetch——
+  // SSRF 守卫在下游统一接线（assertFetchableUrl + redirect:error + 超时），本层不重复
   referenceImage: z.string().min(1).optional(),
   threadId: z.string().min(1),
 })

package/src/server/serverFns/harness/github-workspace.ts

@@ -22,15 +22,15 @@ import { z } from "zod"
 import { getCurrentSession } from "@/lib/session"
 import { encryptApiKey, decryptApiKey } from "@/server/lib/api-key-cipher"
 
-const githubRepoSchema = z.object({
-  owner: z.string().min(1),
-  repo: z.string().min(1),
+// owner/repo 字符白名单：GitHub 命名空间仅含字母数字 - _ .，
+// 防 `../`、`?`、`#` 改写固定 URL 的路径/查询（自伤面收敛）
+const githubRepoRefSchema = z.object({
+  owner: z.string().regex(/^[\w.-]+$/),
+  repo: z.string().regex(/^[\w.-]+$/),
 })
 
-const githubBranchSchema = z.object({
-  owner: z.string().min(1),
-  repo: z.string().min(1),
-})
+// 外部 GitHub API 超时：慢响应不再挂起请求
+const GITHUB_API_TIMEOUT_MS = 15_000
 
 /**
  * 获取当前用户的 GitHub 仓库列表（仅限用户有访问权限的仓库）。
@@ -77,6 +77,7 @@ export const listGithubReposFn = createServerFn({ method: "GET" })
 
     try {
       const response = await fetch("https://api.github.com/user/repos?per_page=100&sort=updated", {
+        signal: AbortSignal.timeout(GITHUB_API_TIMEOUT_MS),
         headers: {
           Authorization: `Bearer ${token}`,
           "User-Agent": "AllBlue",
@@ -99,7 +100,9 @@ export const listGithubReposFn = createServerFn({ method: "GET" })
             default_branch: r.default_branch as string,
           })),
       }
-    } catch {
+    } catch (e) {
+      // 与「未连接 GitHub」区分开：网络异常至少留一条排查线索
+      console.warn(`[github] 仓库列表获取失败: ${e instanceof Error ? e.message : "unknown"}`)
       return { repos: [] }
     }
   })
@@ -108,7 +111,7 @@ export const listGithubReposFn = createServerFn({ method: "GET" })
  * 获取指定仓库的分支列表。
  */
 export const listGithubBranchesFn = createServerFn({ method: "GET" })
-  .validator(githubRepoSchema)
+  .validator(githubRepoRefSchema)
   .handler(async ({ data: { owner, repo } }) => {
     const prisma = await getPrisma()
     const request = getRequest()
@@ -137,6 +140,7 @@ export const listGithubBranchesFn = createServerFn({ method: "GET" })
       const response = await fetch(
         `https://api.github.com/repos/${owner}/${repo}/branches?per_page=100`,
         {
+          signal: AbortSignal.timeout(GITHUB_API_TIMEOUT_MS),
           headers: {
             Authorization: `Bearer ${token}`,
             "User-Agent": "AllBlue",
@@ -154,7 +158,8 @@ export const listGithubBranchesFn = createServerFn({ method: "GET" })
           protected: b.protected as boolean,
         })),
       }
-    } catch {
+    } catch (e) {
+      console.warn(`[github] 分支列表获取失败 repo=${owner}/${repo}: ${e instanceof Error ? e.message : "unknown"}`)
       return { branches: [] }
     }
   })
@@ -164,7 +169,9 @@ export const listGithubBranchesFn = createServerFn({ method: "GET" })
  * BYOK 优先策略：默认只存 session 级 Account，用户显式「保存到服务器」才落库加密。
  */
 export const saveGithubTokenFn = createServerFn({ method: "POST" })
-  .validator(z.object({ token: z.string().min(1) }))
+  // max(255)：GitHub 各类 token 远短于此，超长即误填/滥用
+  // （不做前缀白名单：OAuth App 存量 token 为 40 位十六进制无前缀，前缀校验会误杀）
+  .validator(z.object({ token: z.string().min(1).max(255) }))
   .handler(async ({ data: { token } }) => {
     const prisma = await getPrisma()
     const request = getRequest()

package/src/server/serverFns/harness/media.ts

@@ -36,7 +36,8 @@ import { requireResource } from "@/server/resources"
 
 const GenerateImageSchema = z.object({
   prompt: z.string().min(1),
-  numberOfImages: z.number().optional(),
+  // 上限防止单请求放大生成成本（配额按次扣减，numImages 过大使成本失衡）
+  numberOfImages: z.number().int().min(1).max(10).optional(),
   size: z.string().optional(),
   threadId: z.string(),
 })
@@ -235,7 +236,9 @@ export const generateSpeechFn = createServerFn({ method: "POST" })
   })
 
 const GenerateTranscriptionSchema = z.object({
-  audio: z.any(), // File/Blob/base64，客户端传 FormData
+  // File/Blob/base64，客户端传 FormData；形态跨 JSON/FormData 两种 RPC 序列化，
+  // zod 无法在此静态收窄（下游 generateTranscriptionForUser 以 string|File|Blob|ArrayBuffer 消费）
+  audio: z.any(),
   language: z.string().optional(),
   prompt: z.string().optional(),
   threadId: z.string(),
@@ -309,7 +312,8 @@ export const generatePrototypeFn = createServerFn({ method: "POST" })
     }
     const userId = session.user.id
     await checkAiRateLimit(userId, "mediaPrototype")
-
+    // threadId 归属由下游 generatePrototypeForUser 的 requireThread 校验
+    // （{ id, userId } findFirst，media/index.ts）——与上方各 fn 的本层校验同口径
     return generatePrototypeForUser({
       userId,
       threadId: data.threadId,

package/src/server/serverFns/harness/sandbox-policy.ts

@@ -33,7 +33,7 @@ async function requireOwnedThread(threadId: string) {
   if (!session?.user?.id) throw new Error("Unauthorized")
 
   const prisma = await getPrisma()
-    const thread = await prisma.chatThread.findUnique({
+  const thread = await prisma.chatThread.findUnique({
     where: { id: threadId },
     select: { id: true, userId: true, sandboxPolicy: true },
   })
@@ -47,7 +47,6 @@ async function requireOwnedThread(threadId: string) {
 export const getSandboxPolicyFn = createServerFn({ method: "GET" })
   .validator(threadIdInput)
   .handler(async ({ data }) => {
-    const prisma = await getPrisma()
     const thread = await requireOwnedThread(data.threadId)
     return isSandboxPolicyLevel(thread.sandboxPolicy)
       ? thread.sandboxPolicy

package/src/server/serverFns/harness/search-mention-candidates.ts

@@ -28,7 +28,7 @@ export const searchKbDocsForMentionFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
 
     const accessibleKbs = await prisma.knowledgeBase.findMany({
       where: { userId, isDeleted: false },

package/src/server/serverFns/iteration/__tests__/iteration-crud.test.ts

@@ -52,6 +52,7 @@ const mocks = vi.hoisted(() => ({
   delete: vi.fn(),
   count: vi.fn(),
   groupBy: vi.fn(),
+  storyFindMany: vi.fn(),
   memberFindUnique: vi.fn(),
   projectFindFirst: vi.fn(),
   currentSession: vi.fn(),
@@ -66,7 +67,7 @@ vi.mock("@allbluecn/database", () => ({
       update: mocks.update,
       delete: mocks.delete,
     },
-    story: { groupBy: mocks.groupBy },
+    story: { groupBy: mocks.groupBy, findMany: mocks.storyFindMany },
     iterationAutoSchedule: { findMany: mocks.findMany },
     projectMember: { findUnique: mocks.memberFindUnique },
     project: { findFirst: mocks.projectFindFirst },
@@ -80,6 +81,7 @@ vi.mock("@/server/auth-helpers", () => ({
 
 import {
   listIterationsFn,
+  listIterationStoriesFn,
   createIterationsFn,
   updateIterationsFn,
   archiveIterationsFn,
@@ -310,3 +312,30 @@ describe("deleteIterationsFn", () => {
     expect(mocks.delete).not.toHaveBeenCalled();
   });
 });
+
+describe("listIterationStoriesFn", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.currentSession.mockResolvedValue({ user: { id: "u1" } });
+    mocks.memberFindUnique.mockResolvedValue({ status: "active" });
+  });
+
+  it("成员放行：assignee 走 USER_BRIEF_SELECT 且不含 email（审计 2026-10-25 最小披露）", async () => {
+    mocks.findUnique.mockResolvedValue({ projectId: "p1" });
+    mocks.storyFindMany.mockResolvedValue([
+      { id: "s1", identifier: "STORY-1", name: "需求1", state: "todo", priority: "high", assignee: { id: "u2", username: "bob", avatarConfig: null, bgShape: null, bgColor: null } },
+    ]);
+    const r = await listIterationStoriesFn({ data: { iterationId: "i1" } });
+    expect(r.items).toHaveLength(1);
+    const select = mocks.storyFindMany.mock.calls[0][0].select.assignee.select;
+    expect(select).toHaveProperty("username");
+    expect(select).not.toHaveProperty("email");
+  });
+
+  it("SEC-03：非成员读取被拒", async () => {
+    mocks.findUnique.mockResolvedValue({ projectId: "p1" });
+    mocks.memberFindUnique.mockResolvedValue(null);
+    await expect(listIterationStoriesFn({ data: { iterationId: "i1" } })).rejects.toThrow("无权限操作该项目的迭代");
+    expect(mocks.storyFindMany).not.toHaveBeenCalled();
+  });
+});

package/src/server/serverFns/iteration/__tests__/iteration-stories.test.ts

@@ -53,6 +53,7 @@ const mocks = vi.hoisted(() => ({
   storyFindMany: vi.fn(),
   memberFindUnique: vi.fn(),
   currentSession: vi.fn(),
+  transaction: vi.fn(),
 }));
 
 vi.mock("@allbluecn/database", () => ({
@@ -66,6 +67,8 @@ vi.mock("@allbluecn/database", () => ({
     },
     storyActivity: { create: mocks.create, createMany: mocks.createMany },
     projectMember: { findUnique: mocks.memberFindUnique },
+    // 数组形 $transaction：按序 await 各操作返回值（与 Prisma 语义一致）
+    $transaction: mocks.transaction,
   },
   Prisma: {},
 }));
@@ -83,6 +86,7 @@ beforeEach(() => {
   vi.useFakeTimers();
   vi.setSystemTime(new Date("2026-09-10T00:00:00Z"));
   mocks.memberFindUnique.mockResolvedValue({ status: "active" });
+  mocks.transaction.mockImplementation(async (ops: Promise<unknown>[]) => Promise.all(ops));
 });
 afterEach(() => {
   vi.useRealTimers();
@@ -121,6 +125,8 @@ describe("setStoryIterationFn", () => {
     const r = await setStoryIterationFn({ data: { storyId: "s1", iterationId: "i1" } });
     expect(r.ok).toBe(true);
     expect(mocks.update).toHaveBeenCalledWith(expect.objectContaining({ data: { iterationId: "i1" } }));
+    // story 写与 activity 写同事务（审计 2026-10-25：防中途失败孤儿记录）
+    expect(mocks.transaction).toHaveBeenCalled();
     const activity = mocks.create.mock.calls[0][0].data;
     expect(activity.action).toBe("iteration_changed");
     expect(activity.field).toBe("iterationId");
@@ -134,15 +140,21 @@ describe("addStoriesToIterationFn", () => {
     mocks.currentSession.mockResolvedValue({ user: { id: "u1" } });
   });
 
-  it("批量更新并记录活动", async () => {
+  it("批量更新并记录活动（事务 + skipped 报告）", async () => {
     mocks.findUnique.mockResolvedValue({
       projectId: "p1", startDate: new Date("2026-09-01"), endDate: new Date("2026-09-14"), archived: false, name: "Sprint 1",
     });
-    mocks.storyFindMany.mockResolvedValue([{ projectId: "p1" }, { projectId: "p1" }]);
+    mocks.storyFindMany.mockResolvedValue([
+      { id: "s1", projectId: "p1" },
+      { id: "s2", projectId: "p1" },
+    ]);
     mocks.updateMany.mockResolvedValue({ count: 2 });
     mocks.createMany.mockResolvedValue(undefined);
     const r = await addStoriesToIterationFn({ data: { iterationId: "i1", storyIds: ["s1", "s2"] } });
     expect(r.count).toBe(2);
+    expect(r.skipped).toBe(0);
+    // story 写与 activity 写同事务（审计 2026-10-25）
+    expect(mocks.transaction).toHaveBeenCalledTimes(1);
     expect(mocks.createMany).toHaveBeenCalledWith(expect.objectContaining({
       data: expect.arrayContaining([
         expect.objectContaining({ storyId: "s1", action: "iteration_changed" }),
@@ -151,11 +163,45 @@ describe("addStoriesToIterationFn", () => {
     }));
   });
 
+  it("审计：不存在的 storyId 不进 activity（防 FK 整批 P2003），并以 skipped 报告", async () => {
+    mocks.findUnique.mockResolvedValue({
+      projectId: "p1", startDate: new Date("2026-09-01"), endDate: new Date("2026-09-14"), archived: false, name: "Sprint 1",
+    });
+    // 请求 3 个 id，只有 s1 存在
+    mocks.storyFindMany.mockResolvedValue([{ id: "s1", projectId: "p1" }]);
+    mocks.updateMany.mockResolvedValue({ count: 1 });
+    mocks.createMany.mockResolvedValue(undefined);
+    const r = await addStoriesToIterationFn({ data: { iterationId: "i1", storyIds: ["s1", "ghost-1", "ghost-2"] } });
+    expect(r.count).toBe(1);
+    expect(r.skipped).toBe(2);
+    const activityData = mocks.createMany.mock.calls[0][0].data;
+    expect(activityData).toHaveLength(1);
+    expect(activityData[0]).toMatchObject({ storyId: "s1" });
+    // updateMany 同样只打命中集
+    expect(mocks.updateMany).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { id: { in: ["s1"] } } }),
+    );
+  });
+
+  it("全部 storyId 不存在：零写入直接返回", async () => {
+    mocks.findUnique.mockResolvedValue({
+      projectId: "p1", startDate: new Date("2026-09-01"), endDate: new Date("2026-09-14"), archived: false, name: "Sprint 1",
+    });
+    mocks.storyFindMany.mockResolvedValue([]);
+    const r = await addStoriesToIterationFn({ data: { iterationId: "i1", storyIds: ["ghost"] } });
+    expect(r).toEqual({ count: 0, skipped: 1 });
+    expect(mocks.transaction).not.toHaveBeenCalled();
+    expect(mocks.createMany).not.toHaveBeenCalled();
+  });
+
   it("SEC-03：混入跨项目 story 时整批拒绝、零写入", async () => {
     mocks.findUnique.mockResolvedValue({
       projectId: "p1", startDate: new Date("2026-09-01"), endDate: new Date("2026-09-14"), archived: false, name: "Sprint 1",
     });
-    mocks.storyFindMany.mockResolvedValue([{ projectId: "p1" }, { projectId: "p_foreign" }]);
+    mocks.storyFindMany.mockResolvedValue([
+      { id: "s1", projectId: "p1" },
+      { id: "s2", projectId: "p_foreign" },
+    ]);
     // u1 只在 p1 有成员关系，p_foreign 无
     mocks.memberFindUnique.mockImplementation(async (args: any) =>
       args.where.projectId_userId.projectId === "p1" ? { status: "active" } : null,
@@ -175,7 +221,7 @@ describe("removeStoryFromIterationFn", () => {
     mocks.currentSession.mockResolvedValue({ user: { id: "u1" } });
   });
 
-  it("移出迭代并记录活动", async () => {
+  it("移出迭代并记录活动（事务）", async () => {
     mocks.findUnique.mockResolvedValue({
       projectId: "p1",
       iterationId: "i1",
@@ -185,6 +231,7 @@ describe("removeStoryFromIterationFn", () => {
     mocks.create.mockResolvedValue({ id: "a1" });
     const r = await removeStoryFromIterationFn({ data: { storyId: "s1" } });
     expect(r.ok).toBe(true);
+    expect(mocks.transaction).toHaveBeenCalledTimes(1);
     const activity = mocks.create.mock.calls[0][0].data;
     expect(activity.action).toBe("iteration_changed");
     expect(activity.field).toBe("iterationId");

package/src/server/serverFns/iteration/__tests__/iteration-transfer.test.ts

@@ -45,6 +45,7 @@ vi.mock("@tanstack/react-start/server", () => ({
 }));
 
 const mocks = vi.hoisted(() => ({
+  transaction: vi.fn(),
   findMany: vi.fn(),
   findUnique: vi.fn(),
   updateMany: vi.fn(),
@@ -61,6 +62,8 @@ vi.mock("@allbluecn/database", () => ({
     storyActivity: { createMany: mocks.createMany },
     project: { findUnique: mocks.projectFindUnique },
     projectMember: { findUnique: mocks.memberFindUnique },
+    // transfer-internal 双表写已收进事务（审计 🟡）：tx 即同一组 mock
+    $transaction: mocks.transaction,
   },
   Prisma: {},
 }));
@@ -77,6 +80,12 @@ import { transferUnfinishedFn } from "../iteration-transfer";
 beforeEach(() => {
   vi.useFakeTimers();
   vi.setSystemTime(new Date("2026-09-10T00:00:00Z"));
+  mocks.transaction.mockImplementation(async (fn: (tx: unknown) => Promise<unknown>) =>
+    fn({
+      story: { updateMany: mocks.updateMany },
+      storyActivity: { createMany: mocks.createMany },
+    }),
+  );
   mocks.memberFindUnique.mockResolvedValue({ status: "active" });
 });
 afterEach(() => {

package/src/server/serverFns/iteration/iteration-auto-schedule.ts

@@ -22,30 +22,21 @@ import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { toDatePart } from "@/lib/iteration/status";
 import { ensureUpcomingIterations } from "@/server/iteration/auto-schedule-internal";
+import { assertIterationProjectMembership as assertProjectMembership } from "@/server/iteration/permissions";
 
 const CONFIG_SELECT = {
   enabled: true, title: true, durationDays: true, cooldownDays: true,
   startsOn: true, futureCount: true, autoRollover: true, lastSeq: true,
 } as const;
 
-/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的迭代");
-  }
-}
 
 export const getAutoScheduleFn = createServerFn({ method: "GET" })
   .validator(z.object({ projectId: z.string() }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    await assertProjectMembership(data.projectId, session.user.id);
     const [cfg] = await prisma.iterationAutoSchedule.findMany({
       where: { projectId: data.projectId }, select: CONFIG_SELECT, take: 1,
     });
@@ -70,7 +61,7 @@ export const updateAutoScheduleFn = createServerFn({ method: "POST" })
     const request = getRequest();
     const session = await requireAuth(request);
     // 配置写入会连锁触发排期补建，须为项目有效成员（SEC-03）
-    await assertProjectMembership(data.projectId, session.user!.id!);
+    await assertProjectMembership(data.projectId, session.user.id);
     await prisma.iterationAutoSchedule.upsert({
       where: { projectId: data.projectId },
       create: { ...data, startsOn: new Date(data.startsOn + "T00:00:00.000Z") },

package/src/server/serverFns/iteration/iteration-burndown.ts

@@ -20,8 +20,9 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
+import { assertIterationProjectMember } from "@/server/iteration/permissions";
 import { toDatePart } from "@/lib/iteration/status";
-import { computeBurndown } from "./burndown-core";
+import { computeBurndown } from "@/lib/iteration/burndown";
 
 const ACTIVITY_STORY_SELECT = {
   storyId: true, field: true, oldValue: true, newValue: true, createdAt: true, action: true,
@@ -32,7 +33,8 @@ export const getIterationBurndownFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    await assertIterationProjectMember(data.iterationId, session.user.id);
     const iteration = await prisma.iteration.findUnique({
       where: { id: data.iterationId },
       select: { startDate: true, endDate: true, project: { select: { timezone: true } } },
@@ -54,7 +56,9 @@ export const getIterationBurndownFn = createServerFn({ method: "GET" })
       orderBy: { createdAt: "asc" },
       select: ACTIVITY_STORY_SELECT,
     });
-    // 加入时间：iteration_changed 首次进入本迭代的活动时间，无记录 fallback story.createdAt（规格 §3.4 简化口径）
+    // 加入时间：iteration_changed 最后一次变更的活动时间（需求移出再移回取最近一次
+    // 移回时间；对仍在本迭代的需求，最后一次 iteration_changed 必然是移入事件），
+    // 无记录 fallback story.createdAt（规格 §3.4 简化口径）
     const addedAt = new Map<string, string>();
     for (const a of activities) {
       if (a.action !== "iteration_changed") continue;