@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/iteration/iteration-crud.ts

@@ -31,6 +31,8 @@ import {
 import type { StoryState } from "@/components/story/constants";
 import { ensureUpcomingIterations, ensureAutoRollover } from "@/server/iteration/auto-schedule-internal";
 import { resolveStoryScopeProjectId, resolveStoryScopeProjectIds } from "@/server/builtin-project";
+import { assertIterationProjectMember, assertIterationProjectMembership as assertProjectMembership } from "@/server/iteration/permissions";
+import { USER_BRIEF_SELECT } from "@/server/lib/user-brief";
 
 const ITERATION_SELECT = {
   id: true,
@@ -42,17 +44,6 @@ const ITERATION_SELECT = {
   archived: true,
 } as const;
 
-/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的迭代");
-  }
-}
 
 /** 与项目内未归档迭代校验日期不重叠（规格 §2.1：约束在 serverFn 层） */
 async function assertNoOverlap(projectId: string, range: { startDate: string; endDate: string }, excludeId?: string) {
@@ -93,7 +84,7 @@ export const listIterationsFn = createServerFn({ method: "GET" })
     const session = await requireAuth(request);
     // 读门槛与列表 scope 同口径（SEC-03）：非成员静默回退独立项目，
     // 同时避免借读路径触发他人项目的迭代自愈排期
-    const scopeProjectId = await resolveStoryScopeProjectId(data.projectId, session.user!.id!);
+    const scopeProjectId = await resolveStoryScopeProjectId(data.projectId, session.user.id);
     // 惰性自愈：自动排期补建 + autoRollover（规格 §3.6）
     await ensureUpcomingIterations(scopeProjectId);
     await ensureAutoRollover(scopeProjectId);
@@ -132,7 +123,7 @@ export const listIterationsScopeFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const projectIds = await resolveStoryScopeProjectIds(data.projectId, session.user!.id!);
+    const projectIds = await resolveStoryScopeProjectIds(data.projectId, session.user.id);
     const items = await prisma.iteration.findMany({
       where: { projectId: { in: projectIds }, archived: false },
       select: { id: true, name: true, startDate: true, endDate: true },
@@ -146,7 +137,9 @@ export const getIterationFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    // 读侧与写侧同口径：须为迭代所属项目的有效成员（审计 2026-10-25 读路径缺口）
+    await assertIterationProjectMember(data.id, session.user.id);
     const it = await prisma.iteration.findUnique({ where: { id: data.id }, select: ITERATION_SELECT });
     if (!it) throw new Error("迭代不存在");
     const grouped = await prisma.story.groupBy({
@@ -165,7 +158,7 @@ export const createIterationsFn = createServerFn({ method: "POST" })
     const request = getRequest();
     const session = await requireAuth(request);
     // 与 testcase createTestCaseFn 同范式：建入前校验目标项目成员资格（SEC-03 残口收口）
-    await assertProjectMembership(data.projectId, session.user!.id!);
+    await assertProjectMembership(data.projectId, session.user.id);
     await assertNoOverlap(data.projectId, data);
     const created = await prisma.iteration.create({
       data: {
@@ -174,7 +167,7 @@ export const createIterationsFn = createServerFn({ method: "POST" })
         description: data.description,
         startDate: new Date(data.startDate + "T00:00:00.000Z"),
         endDate: new Date(data.endDate + "T00:00:00.000Z"),
-        createdById: session.user!.id!,
+        createdById: session.user.id,
       },
       select: { id: true },
     });
@@ -187,7 +180,7 @@ export const updateIterationsFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     const existing = await prisma.iteration.findUnique({ where: { id: data.id }, select: ITERATION_SELECT });
     if (!existing) throw new Error("迭代不存在");
     await assertProjectMembership(existing.projectId, userId);
@@ -225,7 +218,7 @@ export const archiveIterationsFn = createServerFn({ method: "POST" })
       select: { id: true, projectId: true },
     });
     if (!existing) throw new Error("迭代不存在");
-    await assertProjectMembership(existing.projectId, session.user!.id!);
+    await assertProjectMembership(existing.projectId, session.user.id);
     await prisma.iteration.update({
       where: { id: data.id },
       data: { archived: data.archived, archivedAt: data.archived ? new Date() : null },
@@ -245,15 +238,11 @@ export const deleteIterationsFn = createServerFn({ method: "POST" })
       select: { id: true, projectId: true },
     });
     if (!existing) throw new Error("迭代不存在");
-    await assertProjectMembership(existing.projectId, session.user!.id!);
+    await assertProjectMembership(existing.projectId, session.user.id);
     await prisma.iteration.delete({ where: { id: data.id } }); // Story.iterationId SetNull 自动解绑
     return { ok: true };
   });
 
-const USER_BRIEF_SELECT = {
-  id: true, username: true, email: true, avatarConfig: true, bgShape: true, bgColor: true,
-} as const;
-
 const listIterationStoriesSchema = z.object({ iterationId: z.string() });
 
 export const listIterationStoriesFn = createServerFn({ method: "GET" })
@@ -261,10 +250,13 @@ export const listIterationStoriesFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    await assertIterationProjectMember(data.iterationId, session.user.id);
     const stories = await prisma.story.findMany({
       where: { iterationId: data.iterationId, archived: false },
       orderBy: [{ state: "asc" }, { updatedAt: "desc" }],
+      // USER_BRIEF_SELECT 不含 email：迭代列表只用于头像/昵称展示，
+      // 成员邮箱非必要不返回（审计 2026-10-25 最小披露口径）
       select: {
         id: true, identifier: true, name: true, state: true, priority: true,
         assignee: { select: USER_BRIEF_SELECT },

package/src/server/serverFns/iteration/iteration-stories.ts

@@ -21,18 +21,8 @@ import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { deriveIterationStatus, toDatePart } from "@/lib/iteration/status";
+import { assertIterationProjectMembership as assertProjectMembership } from "@/server/iteration/permissions";
 
-/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的迭代");
-  }
-}
 
 /** 目标迭代必须可加入：存在、未归档、非 completed、当前用户为项目有效成员（规格 §3.2 + SEC-03） */
 async function assertTargetJoinable(iterationId: string, userId: string) {
@@ -55,7 +45,7 @@ export const setStoryIterationFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     const story = await prisma.story.findUnique({
       where: { id: data.storyId },
       select: { projectId: true, iterationId: true, iteration: { select: { name: true } } },
@@ -65,17 +55,20 @@ export const setStoryIterationFn = createServerFn({ method: "POST" })
     await assertProjectMembership(story.projectId, userId);
     let newName: string | null = null;
     if (data.iterationId) newName = await assertTargetJoinable(data.iterationId, userId);
-    await prisma.story.update({ where: { id: data.storyId }, data: { iterationId: data.iterationId } });
-    await prisma.storyActivity.create({
-      data: {
-        storyId: data.storyId,
-        userId: session.user!.id!,
-        action: "iteration_changed",
-        field: "iterationId",
-        oldValue: story.iteration?.name ?? null,
-        newValue: newName,
-      },
-    });
+    // story 写与 activity 写同事务（审计 2026-10-25：防中途失败产生孤儿/缺活动记录）
+    await prisma.$transaction([
+      prisma.story.update({ where: { id: data.storyId }, data: { iterationId: data.iterationId } }),
+      prisma.storyActivity.create({
+        data: {
+          storyId: data.storyId,
+          userId,
+          action: "iteration_changed",
+          field: "iterationId",
+          oldValue: story.iteration?.name ?? null,
+          newValue: newName,
+        },
+      }),
+    ]);
     return { ok: true };
   });
 
@@ -85,31 +78,39 @@ export const addStoriesToIterationFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     const newName = await assertTargetJoinable(data.iterationId, userId);
     // 批量圈定后按项目去重校验成员资格（SEC-03：任一跨项目 id 整批拒绝，不做部分写入）
     const stories = await prisma.story.findMany({
       where: { id: { in: data.storyIds } },
-      select: { projectId: true },
+      select: { id: true, projectId: true },
     });
     const projectIds = [...new Set(stories.map((s) => s.projectId))];
     for (const projectId of projectIds) {
       await assertProjectMembership(projectId, userId);
     }
-    const { count } = await prisma.story.updateMany({
-      where: { id: { in: data.storyIds } },
-      data: { iterationId: data.iterationId },
-    });
-    await prisma.storyActivity.createMany({
-      data: data.storyIds.map((storyId) => ({
-        storyId,
-        userId,
-        action: "iteration_changed",
-        field: "iterationId",
-        newValue: newName,
-      })),
-    });
-    return { count };
+    // 以 findMany 命中集为准（审计 2026-10-25）：不存在的 id 不进 updateMany /
+    // activity，否则 activity.createMany 因 FK 整批 P2003 500；skipped 供调用方感知差异
+    const foundIds = stories.map((s) => s.id);
+    const skipped = data.storyIds.length - foundIds.length;
+    if (foundIds.length === 0) return { count: 0, skipped };
+    // story 写与 activity 写同事务（审计 2026-10-25：中途失败不再产生活动缺失/孤儿）
+    const [upd] = await prisma.$transaction([
+      prisma.story.updateMany({
+        where: { id: { in: foundIds } },
+        data: { iterationId: data.iterationId },
+      }),
+      prisma.storyActivity.createMany({
+        data: foundIds.map((storyId) => ({
+          storyId,
+          userId,
+          action: "iteration_changed",
+          field: "iterationId",
+          newValue: newName,
+        })),
+      }),
+    ]);
+    return { count: upd.count, skipped };
   });
 
 export const removeStoryFromIterationFn = createServerFn({ method: "POST" })
@@ -118,26 +119,28 @@ export const removeStoryFromIterationFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     const story = await prisma.story.findUnique({
       where: { id: data.storyId },
       select: { projectId: true, iterationId: true, iteration: { select: { name: true } } },
     });
     if (!story?.iterationId) return { ok: true };
     await assertProjectMembership(story.projectId, userId);
-    await prisma.story.updateMany({
-      where: { id: data.storyId, iterationId: story.iterationId },
-      data: { iterationId: null },
-    });
-    await prisma.storyActivity.create({
-      data: {
-        storyId: data.storyId,
-        userId: session.user!.id!,
-        action: "iteration_changed",
-        field: "iterationId",
-        oldValue: story.iteration?.name ?? null,
-        newValue: null,
-      },
-    });
+    await prisma.$transaction([
+      prisma.story.updateMany({
+        where: { id: data.storyId, iterationId: story.iterationId },
+        data: { iterationId: null },
+      }),
+      prisma.storyActivity.create({
+        data: {
+          storyId: data.storyId,
+          userId,
+          action: "iteration_changed",
+          field: "iterationId",
+          oldValue: story.iteration?.name ?? null,
+          newValue: null,
+        },
+      }),
+    ]);
     return { ok: true };
   });

package/src/server/serverFns/iteration/iteration-transfer.ts

@@ -37,7 +37,7 @@ export const transferUnfinishedFn = createServerFn({ method: "POST" })
       data.iterationId,
       data.targetIterationId,
       data.storyIds,
-      session.user!.id!,
+      session.user.id,
     );
     return { count };
   });

package/src/server/serverFns/knowledge/public/bookmarks/categories.ts

@@ -28,7 +28,7 @@ export const listBookmarkCategoriesFn = createServerFn({ method: 'GET' })
     const request = getRequest()
     const session = await requireAuth(request)
     return prisma.bookmarkCategory.findMany({
-      where: { OR: [{ userId: null }, { userId: session.user!.id! }] },
+      where: { OR: [{ userId: null }, { userId: session.user.id }] },
       orderBy: [{ sortOrder: 'asc' }, { name: 'asc' }],
       select: { id: true, name: true, icon: true, sortOrder: true, isDefault: true, userId: true },
     })
@@ -40,18 +40,22 @@ export const createBookmarkCategoryFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const last = await prisma.bookmarkCategory.findFirst({
-      where: { userId: session.user!.id! },
-      orderBy: { sortOrder: 'desc' },
-    })
-    return prisma.bookmarkCategory.create({
-      data: {
-        name: data.name,
-        icon: data.icon,
-        userId: session.user!.id!,
-        sortOrder: (last?.sortOrder ?? 0) + 1,
-      },
-      select: { id: true, name: true, icon: true, sortOrder: true },
+    // max+1 聚合与创建同事务（审计 2026-10-25：收窄 check-then-act 竞态窗口；
+    // 极端并发仍可能重复 sortOrder，展示层按 sortOrder+name 排序可容忍）
+    return prisma.$transaction(async (tx) => {
+      const last = await tx.bookmarkCategory.findFirst({
+        where: { userId: session.user.id },
+        orderBy: { sortOrder: 'desc' },
+      })
+      return tx.bookmarkCategory.create({
+        data: {
+          name: data.name,
+          icon: data.icon,
+          userId: session.user.id,
+          sortOrder: (last?.sortOrder ?? 0) + 1,
+        },
+        select: { id: true, name: true, icon: true, sortOrder: true },
+      })
     })
   })
 
@@ -64,7 +68,7 @@ export const deleteBookmarkCategoryFn = createServerFn({ method: 'POST' })
     const cat = await prisma.bookmarkCategory.findUnique({ where: { id: data.id } })
     if (!cat) throw new Error('未找到')
     if (cat.isDefault) throw new Error('预置分类不可删除')
-    if (cat.userId !== session.user!.id!) throw new Error('无权限')
+    if (cat.userId !== session.user.id) throw new Error('无权限')
     await prisma.bookmarkCategory.delete({ where: { id: data.id } })
     return { success: true }
   })

package/src/server/serverFns/knowledge/public/bookmarks/create.ts

@@ -20,13 +20,21 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
+import { checkUserActionRateLimit } from '@/server/lib/rate-limit'
 import { bookmarkCanonicalId, parseGithubUrl } from '@/server/knowledge/public/canonical-id'
 import { fetchGithubData } from '@/server/knowledge/public/github-sync'
 import { resolveFavicon } from '@/server/knowledge/public/favicon'
+import { httpUrl } from "@/server/lib/validators";
+
+function warnFaviconFailure(scope: string, url: string, e: unknown) {
+  console.warn(
+    `${scope} favicon/GitHub 同步失败 url=${url}: ${e instanceof Error ? e.message : String(e)}`,
+  )
+}
 
 const createSchema = z.object({
   title: z.string().min(1).max(200),
-  url: z.string().url(),
+  url: httpUrl,
   categoryId: z.string().optional(),
   summary: z.string().max(1000).optional(),
   tags: z.array(z.string()).default([]),
@@ -38,11 +46,28 @@ export const createBookmarkFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
+    const userId = session.user.id
+    // categoryId 必须存在且属于当前用户或为公共分类（审计 2026-10-25：
+    // 防把书签挂到他人自定义分类下造成数据关联错乱）
+    if (data.categoryId) {
+      const cat = await prisma.bookmarkCategory.findUnique({
+        where: { id: data.categoryId },
+        select: { userId: true },
+      })
+      if (!cat || (cat.userId !== null && cat.userId !== userId)) {
+        throw new Error('分类不存在或无权限')
+      }
+    }
+    // resolveFavicon 内部已走 assertFetchableUrl + redirect:"error"（SEC-05），
+    // 此处补 per-minute 频控防借创建动作刷服务端外呼（与 refreshFaviconFn 同预算）
+    await checkUserActionRateLimit(userId, 'faviconRefresh')
     const gh = parseGithubUrl(data.url)
     let faviconUrl: string | null = null
     try {
       faviconUrl = await resolveFavicon(data.url)
-    } catch {}
+    } catch (e: unknown) {
+      warnFaviconFailure('创建书签', data.url, e)
+    }
 
     const bookmark = await prisma.websiteBookmark.create({
       data: {
@@ -53,7 +78,7 @@ export const createBookmarkFn = createServerFn({ method: 'POST' })
         summary: data.summary || null,
         tags: data.tags,
         visibility: 'private',
-        userId: session.user!.id!,
+        userId,
         isGithub: !!gh,
         githubOwner: gh?.owner ?? null,
         githubRepo: gh?.repo ?? null,
@@ -79,8 +104,13 @@ export const createBookmarkFn = createServerFn({ method: 'POST' })
               },
             })
           }
-        } catch {}
-      })().catch(() => {})
+        } catch (e: unknown) {
+          // fire-and-forget 保留，但失败留痕（审计 2026-10-25：双层吞错不可排查）
+          warnFaviconFailure('GitHub 同步(创建书签后)', data.url, e)
+        }
+      })().catch((e: unknown) => {
+        warnFaviconFailure('GitHub 同步(创建书签后)', data.url, e)
+      })
     }
 
     return bookmark

package/src/server/serverFns/knowledge/public/bookmarks/delete.ts

@@ -29,8 +29,8 @@ export const deleteBookmarkFn = createServerFn({ method: 'POST' })
     const session = await requireAuth(request)
     const existing = await prisma.websiteBookmark.findUnique({ where: { id: data.id } })
     if (!existing) throw new Error('未找到')
-    const isOwner = existing.userId === session.user!.id!
-    const isAdmin = session.user!.role === 'ADMIN' || session.user!.role === 'SUPER_ADMIN'
+    const isOwner = existing.userId === session.user.id
+    const isAdmin = session.user.role === 'ADMIN' || session.user.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
     await prisma.websiteBookmark.update({ where: { id: data.id }, data: { isDeleted: true } })
     return { success: true }

package/src/server/serverFns/knowledge/public/bookmarks/detail.ts

@@ -28,7 +28,7 @@ export const getBookmarkDetailFn = createServerFn({ method: 'GET' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     const item = await prisma.websiteBookmark.findFirst({
       where: { id: data.id, isDeleted: false },
       include: { category: { select: { icon: true } } },

package/src/server/serverFns/knowledge/public/bookmarks/favorite.ts

@@ -27,14 +27,24 @@ export const toggleFavoriteBookmarkFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
-    // DB-03：同 toggleFavoriteFn——deleteMany 计数判定合并查后写，防并发重复收藏
+    const userId = session.user.id
+    // DB-03：同 toggleFavoriteFn——deleteMany 计数判定合并查后写，防并发重复收藏。
+    // 审计 2026-10-25 核实：ArticleFavorite 有 @@unique([entityType, entityId, userId])
+    // 兜底，并发双击时 create 撞唯一约束（P2002）——按「已收藏」语义吞掉该竞态。
     const removed = await prisma.articleFavorite.deleteMany({
       where: { entityType: 'bookmark', entityId: data.canonicalId, userId },
     })
     if (removed.count > 0) {
       return { favorited: false }
     }
-    await prisma.articleFavorite.create({ data: { entityType: 'bookmark', entityId: data.canonicalId, userId } })
+    try {
+      await prisma.articleFavorite.create({ data: { entityType: 'bookmark', entityId: data.canonicalId, userId } })
+    } catch (e: unknown) {
+      // duck-type code 判 P2002（serverFn 文件禁止值引入 Prisma runtime）
+      if ((e as { code?: string })?.code === 'P2002') {
+        return { favorited: true }
+      }
+      throw e
+    }
     return { favorited: true }
   })

package/src/server/serverFns/knowledge/public/bookmarks/list.ts

@@ -38,7 +38,7 @@ export const listBookmarksFn = createServerFn({ method: 'GET' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     const where: Prisma.WebsiteBookmarkWhereInput = { isDeleted: false }
     if (data.scope === 'private') {
       where.userId = userId
@@ -51,6 +51,8 @@ export const listBookmarksFn = createServerFn({ method: 'GET' })
         distinct: ['canonicalId'],
       })
       const otherSharedIds = Array.from(new Set(otherShared.map((r) => r.canonicalId)))
+      // 首支覆盖「他人分享的全部 public 行」；第二支只补一个边角场景：
+      // 自己也分享过的行（userId = 本人）不能因首支的 not 漏掉
       where.AND = [
         { OR: [{ userId: { not: userId } }, { canonicalId: { in: otherSharedIds } }] },
       ]
@@ -65,7 +67,8 @@ export const listBookmarksFn = createServerFn({ method: 'GET' })
         select: { entityId: true },
       })
       const ids = favs.map((f) => f.entityId)
-      where.canonicalId = { in: ids.length ? ids : ['__none__'] }
+      // Prisma in: [] 生成恒假条件——无收藏时直接空结果（替代旧 '__none__' 魔法哨兵）
+      where.canonicalId = { in: ids }
     }
     if (data.search) {
       where.OR = [

package/src/server/serverFns/knowledge/public/bookmarks/refresh-favicon.ts

@@ -19,6 +19,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
+import { getPrisma } from '@allbluecn/database/get-prisma'
 import { checkUserActionRateLimit } from '@/server/lib/rate-limit'
 import { syncBookmarkFavicon } from '@/server/knowledge/public/favicon'
 
@@ -27,11 +28,16 @@ export const refreshFaviconFn = createServerFn({ method: 'POST' })
   .handler(async ({ data }) => {
     const request = getRequest()
     const session = await requireAuth(request)
-    if (!session?.user?.id) {
-      return { success: false, faviconUrl: null }
-    }
+    const userId = session.user.id
     // P3：favicon 外链拉取 per-minute 频控（防借服务端代理扫描外网）
-    await checkUserActionRateLimit(session.user.id, 'faviconRefresh')
+    await checkUserActionRateLimit(userId, 'faviconRefresh')
+    // 仅书签属主可触发服务端外呼（审计 2026-10-25：裸 id 可让任意登录用户借服务端拉任意书签）
+    const prisma = await getPrisma()
+    const owned = await prisma.websiteBookmark.findFirst({
+      where: { id: data.id, isDeleted: false, userId },
+      select: { id: true },
+    })
+    if (!owned) throw new Error('书签不存在')
     const url = await syncBookmarkFavicon(data.id)
     return { success: !!url, faviconUrl: url }
   })

package/src/server/serverFns/knowledge/public/bookmarks/share.ts

@@ -28,7 +28,7 @@ export const shareBookmarkFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     const source = await prisma.websiteBookmark.findFirst({
       where: { id: data.id, userId, isDeleted: false },
     })
@@ -66,10 +66,7 @@ export const shareBookmarkFn = createServerFn({ method: 'POST' })
         userId,
       },
     })
-    const messages = {
-      created: '已分享到公共知识库',
-      appended: '已加入分享(内容已存在,你的头像已追加)',
-      already: '你已分享过此内容',
-    }
-    return { result, message: messages[result.action as 'created' | 'appended' | 'already'] }
+    // 文案协议化（审计 A2x-4/A2x-5 待决策收口）：只回机器可读 action，
+    // 客户端按 m.knowledge_shareResult_* 渲染，服务端不再持有中文文案
+    return { result, action: result.action }
   })

package/src/server/serverFns/knowledge/public/bookmarks/sync-github.ts

@@ -19,13 +19,24 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
+import { getPrisma } from '@allbluecn/database/get-prisma'
+import { checkUserActionRateLimit } from '@/server/lib/rate-limit'
 import { syncBookmarkGithub } from '@/server/knowledge/public/github-sync'
 
 export const syncBookmarkGithubFn = createServerFn({ method: 'POST' })
   .validator(z.object({ id: z.string() }))
   .handler(async ({ data }) => {
     const request = getRequest()
-    await requireAuth(request)
+    const session = await requireAuth(request)
+    // 仅书签属主可触发 GitHub 同步（审计 2026-10-25：裸 id 可对任意书签发起服务端
+    // GitHub 外呼）；#485 已补属主校验，此处补 per-minute 频控堵配额放大
+    await checkUserActionRateLimit(session.user.id, 'githubSync')
+    const prisma = await getPrisma()
+    const owned = await prisma.websiteBookmark.findFirst({
+      where: { id: data.id, isDeleted: false, userId: session.user.id },
+      select: { id: true },
+    })
+    if (!owned) throw new Error('书签不存在')
     const ok = await syncBookmarkGithub(data.id)
     return { success: ok }
   })

package/src/server/serverFns/knowledge/public/bookmarks/unshare.ts

@@ -27,7 +27,7 @@ export const unshareBookmarkFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     await prisma.knowledgeShareRecord.deleteMany({
       where: { entityType: 'bookmark', canonicalId: data.canonicalId, userId },
     })