@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/knowledge/public/bookmarks/update.ts

@@ -21,14 +21,22 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
+import { checkUserActionRateLimit } from '@/server/lib/rate-limit'
 import { bookmarkCanonicalId, parseGithubUrl } from '@/server/knowledge/public/canonical-id'
 import { fetchGithubData } from '@/server/knowledge/public/github-sync'
 import { resolveFavicon } from '@/server/knowledge/public/favicon'
+import { httpUrl } from "@/server/lib/validators";
+
+function warnFaviconFailure(scope: string, url: string, e: unknown) {
+  console.warn(
+    `${scope} favicon/GitHub 同步失败 url=${url}: ${e instanceof Error ? e.message : String(e)}`,
+  )
+}
 
 const updateSchema = z.object({
   id: z.string(),
   title: z.string().min(1).max(200).optional(),
-  url: z.string().url().optional(),
+  url: httpUrl.optional(),
   categoryId: z.string().nullable().optional(),
   summary: z.string().max(1000).nullable().optional(),
   tags: z.array(z.string()).optional(),
@@ -43,49 +51,64 @@ export const updateBookmarkFn = createServerFn({ method: 'POST' })
     const { id, ...rest } = data
     const existing = await prisma.websiteBookmark.findUnique({ where: { id } })
     if (!existing) throw new Error('未找到')
-    const isOwner = existing.userId === session.user!.id!
-    const isAdmin = session.user!.role === 'ADMIN' || session.user!.role === 'SUPER_ADMIN'
+    const isOwner = existing.userId === session.user.id
+    const isAdmin = session.user.role === 'ADMIN' || session.user.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
 
     const updateData: Prisma.WebsiteBookmarkUncheckedUpdateInput = { ...rest }
     const urlChanged = data.url !== undefined && data.url !== existing.url
+    // url 变更只解析一次（审计 🟢：曾重复调用两次）
+    const nextGh = urlChanged && data.url ? parseGithubUrl(data.url) : null
     if (urlChanged && data.url) {
-      const gh = parseGithubUrl(data.url)
       updateData.canonicalId = bookmarkCanonicalId(data.url)
-      updateData.isGithub = !!gh
-      updateData.githubOwner = gh?.owner ?? null
-      updateData.githubRepo = gh?.repo ?? null
+      updateData.isGithub = !!nextGh
+      updateData.githubOwner = nextGh?.owner ?? null
+      updateData.githubRepo = nextGh?.repo ?? null
+      // 旧仓库统计一并清空（审计 2026-10-25：改成非 GitHub URL 后旧 star/版本
+      // 不再永久残留展示；若新 URL 仍是 GitHub，下方异步同步会重新写入）
+      updateData.githubStars = null
+      updateData.githubLatestVersion = null
+      updateData.githubVersionDate = null
+      updateData.githubRepoUpdatedAt = null
+      updateData.githubSyncedAt = null
+      // resolveFavicon 内部已走 assertFetchableUrl + redirect:"error"（SEC-05），
+      // 此处补 per-minute 频控（与 refreshFaviconFn 同预算）
+      await checkUserActionRateLimit(session.user.id, 'faviconRefresh')
       try {
         updateData.faviconUrl = await resolveFavicon(data.url)
         updateData.faviconSyncedAt = new Date()
-      } catch {}
+      } catch (e: unknown) {
+        warnFaviconFailure('更新书签', data.url, e)
+      }
     }
 
     const updated = await prisma.websiteBookmark.update({
       where: { id }, data: updateData, select: { id: true },
     })
 
-    if (urlChanged && data.url) {
-      const gh = parseGithubUrl(data.url)
-      if (gh) {
-        (async () => {
-          try {
-            const gd = await fetchGithubData(gh.owner, gh.repo)
-            if (gd) {
-              await prisma.websiteBookmark.update({
-                where: { id },
-                data: {
-                  githubStars: gd.stars,
-                  githubRepoUpdatedAt: gd.repoUpdatedAt,
-                  githubLatestVersion: gd.latestVersion,
-                  githubVersionDate: gd.versionDate,
-                  githubSyncedAt: new Date(),
-                },
-              })
-            }
-          } catch {}
-        })().catch(() => {})
-      }
+    if (nextGh) {
+      (async () => {
+        try {
+          const gd = await fetchGithubData(nextGh.owner, nextGh.repo)
+          if (gd) {
+            await prisma.websiteBookmark.update({
+              where: { id },
+              data: {
+                githubStars: gd.stars,
+                githubRepoUpdatedAt: gd.repoUpdatedAt,
+                githubLatestVersion: gd.latestVersion,
+                githubVersionDate: gd.versionDate,
+                githubSyncedAt: new Date(),
+              },
+            })
+          }
+        } catch (e: unknown) {
+          // fire-and-forget 保留，但失败留痕（审计 2026-10-25：双层吞错不可排查）
+          warnFaviconFailure('GitHub 同步(更新书签后)', data.url ?? '', e)
+        }
+      })().catch((e: unknown) => {
+        warnFaviconFailure('GitHub 同步(更新书签后)', data.url ?? '', e)
+      })
     }
 
     return updated

package/src/server/serverFns/knowledge/public/compliance/create.ts

@@ -21,6 +21,7 @@ import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
 import { complianceCanonicalId } from '@/server/knowledge/public/canonical-id'
+import { httpUrl } from "@/server/lib/validators";
 
 const createSchema = z.object({
   title: z.string().min(1).max(200),
@@ -31,7 +32,7 @@ const createSchema = z.object({
   summary: z.string().max(1000).optional(),
   content: z.string().optional(),
   requirements: z.array(z.object({ title: z.string(), detail: z.string() })).default([]),
-  sourceUrl: z.string().url().optional().or(z.literal('')),
+  sourceUrl: httpUrl.optional().or(z.literal('')),
   tags: z.array(z.string()).default([]),
 })
 
@@ -54,7 +55,7 @@ export const createComplianceFn = createServerFn({ method: 'POST' })
         sourceUrl: data.sourceUrl || null,
         tags: data.tags,
         visibility: 'private',
-        userId: session.user!.id!,
+        userId: session.user.id,
       },
       select: { id: true },
     })

package/src/server/serverFns/knowledge/public/compliance/delete.ts

@@ -29,8 +29,8 @@ export const deleteComplianceFn = createServerFn({ method: 'POST' })
     const session = await requireAuth(request)
     const existing = await prisma.industryCompliance.findUnique({ where: { id: data.id } })
     if (!existing) throw new Error('未找到')
-    const isOwner = existing.userId === session.user!.id!
-    const isAdmin = session.user!.role === 'ADMIN' || session.user!.role === 'SUPER_ADMIN'
+    const isOwner = existing.userId === session.user.id
+    const isAdmin = session.user.role === 'ADMIN' || session.user.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
     await prisma.industryCompliance.update({ where: { id: data.id }, data: { isDeleted: true } })
     return { success: true }

package/src/server/serverFns/knowledge/public/compliance/detail.ts

@@ -37,7 +37,7 @@ export const getComplianceDetailFn = createServerFn({ method: 'GET' })
       },
     })
     if (!item) throw new Error('未找到')
-    if (item.visibility === 'private' && item.userId !== session.user!.id!) {
+    if (item.visibility === 'private' && item.userId !== session.user.id) {
       throw new Error('无权限')
     }
     let sharers: PublicSharer[] = []

package/src/server/serverFns/knowledge/public/compliance/list.ts

@@ -28,12 +28,15 @@ const listSchema = z.object({
   search: z.string().optional(),
   industry: z.string().optional(),
   region: z.string().optional(),
-  tags: z.array(z.string()).optional(),
   tag: z.string().optional(),
   page: z.number().int().min(1).default(1),
   pageSize: z.number().int().min(1).max(60).default(24),
 })
 
+// 占位行过滤：历史/Pro 种子数据中存在 title 恰为「未命名合规」的空占位行，
+// 列表一律不展示（命名常量避免魔法字符串散落；来源无代码内创建点，属数据侧约定）
+const UNNAMED_COMPLIANCE_PLACEHOLDER_TITLE = '未命名合规'
+
 export const listComplianceFn = createServerFn({ method: 'GET' })
   .validator(listSchema)
   .handler(async ({ data }) => {
@@ -41,8 +44,8 @@ export const listComplianceFn = createServerFn({ method: 'GET' })
     const request = getRequest()
     const session = await requireAuth(request)
     const where: Prisma.IndustryComplianceWhereInput = { isDeleted: false }
-    where.NOT = { title: '未命名合规' }
-    const userId = session.user!.id!
+    where.NOT = { title: UNNAMED_COMPLIANCE_PLACEHOLDER_TITLE }
+    const userId = session.user.id
     if (data.scope === 'private') {
       where.userId = userId
       where.visibility = 'private'

package/src/server/serverFns/knowledge/public/compliance/public.ts

@@ -19,21 +19,25 @@ import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
 
+// 公开分享页专用端点（/share/compliance/$id beforeLoad 消费，匿名可访问为设计意图，
+// 与 legal/public.ts 同型，不加 requireAuth——审计 2026-10-25 第 1 条按此口径判误报）。
+// 安全边界 = 只返回 public 版本行：请求 id 即便是他人 private 副本（同 canonicalId），
+// 也只回 public 行内容（审计第 2 条：原实现借「公有副本存在」放行私有行读取，逻辑错位）。
 export const getPublicComplianceFn = createServerFn({ method: 'GET' })
   .validator(z.object({ id: z.string() }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const source = await prisma.industryCompliance.findFirst({
       where: { id: data.id, isDeleted: false },
-      include: {
-        user: { select: { id: true, username: true, avatarConfig: true, bgShape: true, bgColor: true } },
-      },
+      select: { id: true, canonicalId: true },
     })
     if (!source) throw new Error('未找到')
     const publicVer = await prisma.industryCompliance.findFirst({
       where: { canonicalId: source.canonicalId, visibility: 'public', isDeleted: false },
-      select: { id: true },
+      include: {
+        user: { select: { id: true, username: true, avatarConfig: true, bgShape: true, bgColor: true } },
+      },
     })
     if (!publicVer) throw new Error('未分享')
-    return source
+    return publicVer
   })

package/src/server/serverFns/knowledge/public/compliance/share.ts

@@ -28,7 +28,7 @@ export const shareComplianceFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     const source = await prisma.industryCompliance.findFirst({
       where: { id: data.id, userId, isDeleted: false },
     })
@@ -54,10 +54,7 @@ export const shareComplianceFn = createServerFn({ method: 'POST' })
         userId,
       },
     })
-    const messages = {
-      created: '已分享到公共知识库',
-      appended: '已加入分享(内容已存在,你的头像已追加)',
-      already: '你已分享过此内容',
-    }
-    return { result, message: messages[result.action as 'created' | 'appended' | 'already'] }
+    // 文案协议化（审计 A2x-4/A2x-5 待决策收口）：只回机器可读 action，
+    // 客户端按 m.knowledge_shareResult_* 渲染，服务端不再持有中文文案
+    return { result, action: result.action }
   })

package/src/server/serverFns/knowledge/public/compliance/unshare.ts

@@ -27,8 +27,21 @@ export const unshareComplianceFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
+    const userId = session.user.id
     await prisma.knowledgeShareRecord.deleteMany({
-      where: { entityType: 'compliance', canonicalId: data.canonicalId, userId: session.user!.id! },
+      where: { entityType: 'compliance', canonicalId: data.canonicalId, userId },
     })
+    // 对齐 unshareBookmarkFn（审计 2026-10-25：分享是把本人行置 public，取消分享
+    // 若无其他分享者必须把本人 public 行回落 private，否则「取消分享」名不副实）
+    const otherSharer = await prisma.knowledgeShareRecord.findFirst({
+      where: { entityType: 'compliance', canonicalId: data.canonicalId, userId: { not: userId } },
+      select: { id: true },
+    })
+    if (!otherSharer) {
+      await prisma.industryCompliance.updateMany({
+        where: { canonicalId: data.canonicalId, userId, visibility: 'public', isDeleted: false },
+        data: { visibility: 'private' },
+      })
+    }
     return { success: true }
   })

package/src/server/serverFns/knowledge/public/compliance/update.ts

@@ -22,6 +22,7 @@ import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
 import { complianceCanonicalId } from '@/server/knowledge/public/canonical-id'
+import { httpUrl } from "@/server/lib/validators";
 
 const updateSchema = z.object({
   id: z.string(),
@@ -33,7 +34,7 @@ const updateSchema = z.object({
   summary: z.string().max(1000).nullable().optional(),
   content: z.string().nullable().optional(),
   requirements: z.array(z.object({ title: z.string(), detail: z.string() })).optional(),
-  sourceUrl: z.string().url().nullable().or(z.literal('')).optional(),
+  sourceUrl: httpUrl.nullable().or(z.literal('')).optional(),
   tags: z.array(z.string()).optional(),
 })
 
@@ -46,15 +47,19 @@ export const updateComplianceFn = createServerFn({ method: 'POST' })
     const { id, code, ...rest } = data
     const existing = await prisma.industryCompliance.findUnique({ where: { id } })
     if (!existing) throw new Error('未找到')
-    const isOwner = existing.userId === session.user!.id!
-    const isAdmin = session.user!.role === 'ADMIN' || session.user!.role === 'SUPER_ADMIN'
+    const isOwner = existing.userId === session.user.id
+    const isAdmin = session.user.role === 'ADMIN' || session.user.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
 
     const updateData: Prisma.IndustryComplianceUncheckedUpdateInput = { ...rest }
-    if (code !== undefined || data.title !== undefined) {
+    if (code !== undefined) {
+      // 仅在显式传入 code 时重算 canonicalId（审计 2026-10-25，主会话裁定）：
+      // 仅改 title 时若按「title+回退 code」重算，会因 IndustryCompliance 无 code 列
+      // 而丢失 code 维度，历史收藏/分享关联（entityId=canonicalId）静默失联。
+      // code 未传 → canonicalId 保持不变，历史关联稳定。
       updateData.canonicalId = complianceCanonicalId({
         title: data.title ?? existing.title,
-        code: code ?? undefined,
+        code,
       })
     }
     return prisma.industryCompliance.update({ where: { id }, data: updateData, select: { id: true } })

package/src/server/serverFns/knowledge/public/dictionary/create.ts

@@ -21,14 +21,16 @@ import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
 import { dictionaryCanonicalId } from '@/server/knowledge/public/canonical-id'
+import { httpUrl } from "@/server/lib/validators";
 
 const createSchema = z.object({
   title: z.string().min(1).max(200),
   industry: z.string().min(1),
-  definition: z.string().optional(),
+  // 与其余字段对齐补长度上限（审计 2026-10-25：防写入超长文本）
+  definition: z.string().max(2000).optional(),
   aliases: z.array(z.string()).default([]),
   examples: z.array(z.string()).default([]),
-  referenceUrl: z.string().url().optional().or(z.literal('')),
+  referenceUrl: httpUrl.optional().or(z.literal('')),
   tags: z.array(z.string()).default([]),
 })
 
@@ -49,7 +51,7 @@ export const createDictionaryFn = createServerFn({ method: 'POST' })
         referenceUrl: data.referenceUrl || null,
         tags: data.tags,
         visibility: 'private',
-        userId: session.user!.id!,
+        userId: session.user.id,
       },
       select: { id: true },
     })

package/src/server/serverFns/knowledge/public/dictionary/delete.ts

@@ -29,8 +29,8 @@ export const deleteDictionaryFn = createServerFn({ method: 'POST' })
     const session = await requireAuth(request)
     const existing = await prisma.dictionaryTerm.findUnique({ where: { id: data.id } })
     if (!existing) throw new Error('未找到')
-    const isOwner = existing.userId === session.user!.id!
-    const isAdmin = session.user!.role === 'ADMIN' || session.user!.role === 'SUPER_ADMIN'
+    const isOwner = existing.userId === session.user.id
+    const isAdmin = session.user.role === 'ADMIN' || session.user.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
     await prisma.dictionaryTerm.update({ where: { id: data.id }, data: { isDeleted: true } })
     return { success: true }

package/src/server/serverFns/knowledge/public/dictionary/detail.ts

@@ -32,7 +32,7 @@ export const getDictionaryDetailFn = createServerFn({ method: 'GET' })
       where: { id: data.id, isDeleted: false },
     })
     if (!item) throw new Error('未找到')
-    if (item.visibility === 'private' && item.userId !== session.user!.id!) {
+    if (item.visibility === 'private' && item.userId !== session.user.id) {
       throw new Error('无权限')
     }
     let sharers: PublicSharer[] = []

package/src/server/serverFns/knowledge/public/dictionary/list.ts

@@ -27,7 +27,8 @@ const listSchema = z.object({
   scope: z.enum(['all', 'private', 'share', 'favorite']).default('all'),
   search: z.string().optional(),
   industry: z.string().optional(),
-  tags: z.array(z.string()).optional(),
+  // tags 死参数已删除（审计 🟢）：handler 全程未消费；zod 默认 strip 未声明键，
+  // 旧调用方即便传入也无契约影响
   page: z.number().int().min(1).default(1),
   pageSize: z.number().int().min(1).max(60).default(24),
 })
@@ -39,7 +40,7 @@ export const listDictionaryFn = createServerFn({ method: 'GET' })
     const request = getRequest()
     const session = await requireAuth(request)
     const where: Prisma.DictionaryTermWhereInput = { isDeleted: false }
-    const userId = session.user!.id!
+    const userId = session.user.id
     if (data.scope === 'private') {
       where.userId = userId
       where.visibility = 'private'

package/src/server/serverFns/knowledge/public/dictionary/share.ts

@@ -28,7 +28,7 @@ export const shareDictionaryFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     const source = await prisma.dictionaryTerm.findFirst({
       where: { id: data.id, userId, isDeleted: false },
     })
@@ -52,10 +52,7 @@ export const shareDictionaryFn = createServerFn({ method: 'POST' })
         userId,
       },
     })
-    const messages = {
-      created: '已分享到公共知识库',
-      appended: '已加入分享(内容已存在,你的头像已追加)',
-      already: '你已分享过此内容',
-    }
-    return { result, message: messages[result.action as 'created' | 'appended' | 'already'] }
+    // 文案协议化（审计 A2x-4/A2x-5 待决策收口）：只回机器可读 action，
+    // 客户端按 m.knowledge_shareResult_* 渲染，服务端不再持有中文文案
+    return { result, action: result.action }
   })

package/src/server/serverFns/knowledge/public/dictionary/unshare.ts

@@ -28,7 +28,7 @@ export const unshareDictionaryFn = createServerFn({ method: 'POST' })
     const request = getRequest()
     const session = await requireAuth(request)
     await prisma.knowledgeShareRecord.deleteMany({
-      where: { entityType: 'dictionary', canonicalId: data.canonicalId, userId: session.user!.id! },
+      where: { entityType: 'dictionary', canonicalId: data.canonicalId, userId: session.user.id },
     })
     return { success: true }
   })

package/src/server/serverFns/knowledge/public/dictionary/update.ts

@@ -22,6 +22,7 @@ import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
 import { dictionaryCanonicalId } from '@/server/knowledge/public/canonical-id'
+import { httpUrl } from "@/server/lib/validators";
 
 const updateSchema = z.object({
   id: z.string(),
@@ -30,7 +31,7 @@ const updateSchema = z.object({
   definition: z.string().nullable().optional(),
   aliases: z.array(z.string()).optional(),
   examples: z.array(z.string()).optional(),
-  referenceUrl: z.string().url().nullable().or(z.literal('')).optional(),
+  referenceUrl: httpUrl.nullable().or(z.literal('')).optional(),
   tags: z.array(z.string()).optional(),
 })
 
@@ -42,8 +43,8 @@ export const updateDictionaryFn = createServerFn({ method: 'POST' })
     const session = await requireAuth(request)
     const existing = await prisma.dictionaryTerm.findUnique({ where: { id: data.id } })
     if (!existing) throw new Error('未找到')
-    const isOwner = existing.userId === session.user!.id!
-    const isAdmin = session.user!.role === 'ADMIN' || session.user!.role === 'SUPER_ADMIN'
+    const isOwner = existing.userId === session.user.id
+    const isAdmin = session.user.role === 'ADMIN' || session.user.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
 
     const updateData: Prisma.DictionaryTermUncheckedUpdateInput = { ...data }

package/src/server/serverFns/knowledge/public/entity-tags.ts

@@ -16,36 +16,42 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
+import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
 
-const TABLE_MAP: Record<string, string> = {
-  legal: '"legal_regulations"',
-  compliance: '"industry_compliances"',
-  dictionary: '"dictionary_terms"',
-  bookmark: '"website_bookmarks"',
+const ENTITY_TYPES = ['legal', 'compliance', 'dictionary', 'bookmark'] as const
+type EntityType = (typeof ENTITY_TYPES)[number]
+
+// 表名片段为开发者维护的固定常量（非用户输入），经 Prisma.raw 显式标记为
+// 原样片段（审计 🔵：消除 $queryRawUnsafe，让「白名单拼接」由类型分派构造
+// 保证——Record<EntityType, Prisma.Sql> + zod enum 使缺表/多表在编译期即报错，
+// 用户 id 走 ${} 参数化）
+const TABLE_MAP: Record<EntityType, Prisma.Sql> = {
+  legal: Prisma.raw('"legal_regulations"'),
+  compliance: Prisma.raw('"industry_compliances"'),
+  dictionary: Prisma.raw('"dictionary_terms"'),
+  bookmark: Prisma.raw('"website_bookmarks"'),
 }
 
 export const getEntityTagsFn = createServerFn({ method: 'GET' })
-  .validator(z.object({ entityType: z.enum(['legal', 'compliance', 'dictionary', 'bookmark']) }))
+  .validator(z.object({ entityType: z.enum(ENTITY_TYPES) }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
-    const table = TABLE_MAP[data.entityType]
-    if (!table) return []
+    const userId = session.user.id
 
-    const rows: { tag: string }[] = await prisma.$queryRawUnsafe(`
+    const rows = await prisma.$queryRaw<{ tag: string }[]>`
       SELECT DISTINCT jsonb_array_elements_text("tags") as tag
-      FROM ${table}
+      FROM ${TABLE_MAP[data.entityType]}
       WHERE "isDeleted" = false
         AND "tags" IS DISTINCT FROM '[]'::jsonb
-        AND ("userId" = $1 OR "visibility" = 'public')
+        AND ("userId" = ${userId} OR "visibility" = 'public')
       ORDER BY tag
-    `, userId)
+    `
 
     return rows.map(r => r.tag).filter(Boolean)
   })

package/src/server/serverFns/knowledge/public/favorite.ts

@@ -21,13 +21,27 @@ import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
 
+// entityType 收敛为知识库公开域的固定集合（审计 ⚪：自由字符串可写入任意
+// entityType 造成自表数据污染；与 entity-tags.ts 的取值域保持一致）。
+// 校验在 handler 内做而非 validator enum：validator 的字面量联合会成为客户端
+// RPC 参数类型，迫使 public-doc-share-page（entityType: string，组件批次范围）
+// 同步改类型。
+const FAVORITE_ENTITY_TYPES = ['legal', 'compliance', 'dictionary', 'bookmark'] as const
+
+function assertFavoriteEntityType(entityType: string): void {
+  if (!(FAVORITE_ENTITY_TYPES as readonly string[]).includes(entityType)) {
+    throw new Error(`不支持的 entityType: ${entityType}`)
+  }
+}
+
 export const toggleFavoriteFn = createServerFn({ method: 'POST' })
   .validator(z.object({ entityType: z.string(), entityId: z.string() }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
+    assertFavoriteEntityType(data.entityType)
     // DB-03：toggle 的查后写（findFirst→delete/create）改为 deleteMany 计数判定，
     // 已收藏路径 1 次查询完成。防重实际靠 ArticleFavorite 的
     // @@unique([entityType, entityId, userId])（schema.prisma）兜底：deleteMany→create
@@ -50,7 +64,8 @@ export const getFavoriteIdsFn = createServerFn({ method: 'GET' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
+    assertFavoriteEntityType(data.entityType)
     const favorites = await prisma.articleFavorite.findMany({
       where: { entityType: data.entityType, userId },
       select: { entityId: true },

package/src/server/serverFns/knowledge/public/legal/create.ts

@@ -21,6 +21,7 @@ import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
 import { legalCanonicalId } from '@/server/knowledge/public/canonical-id'
+import { httpUrl } from "@/server/lib/validators";
 
 const createSchema = z.object({
   title: z.string().min(1).max(200),
@@ -33,7 +34,7 @@ const createSchema = z.object({
   effectiveDate: z.coerce.date().nullable().optional(),
   summary: z.string().max(1000).optional(),
   content: z.string().optional(),
-  sourceUrl: z.string().url().optional().or(z.literal('')),
+  sourceUrl: httpUrl.optional().or(z.literal('')),
   tags: z.array(z.string()).default([]),
 })
 
@@ -58,7 +59,7 @@ export const createLegalFn = createServerFn({ method: 'POST' })
         sourceUrl: data.sourceUrl || null,
         tags: data.tags,
         visibility: 'private',
-        userId: session.user!.id!,
+        userId: session.user.id,
       },
       select: { id: true },
     })

package/src/server/serverFns/knowledge/public/legal/delete.ts

@@ -29,8 +29,8 @@ export const deleteLegalFn = createServerFn({ method: 'POST' })
     const session = await requireAuth(request)
     const existing = await prisma.legalRegulation.findUnique({ where: { id: data.id } })
     if (!existing) throw new Error('未找到')
-    const isOwner = existing.userId === session.user!.id!
-    const isAdmin = session.user!.role === 'ADMIN' || session.user!.role === 'SUPER_ADMIN'
+    const isOwner = existing.userId === session.user.id
+    const isAdmin = session.user.role === 'ADMIN' || session.user.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
     await prisma.legalRegulation.update({ where: { id: data.id }, data: { isDeleted: true } })
     return { success: true }

package/src/server/serverFns/knowledge/public/legal/detail.ts

@@ -37,7 +37,7 @@ export const getLegalDetailFn = createServerFn({ method: 'GET' })
       },
     })
     if (!item) throw new Error('未找到')
-    if (item.visibility === 'private' && item.userId !== session.user!.id!) {
+    if (item.visibility === 'private' && item.userId !== session.user.id) {
       throw new Error('无权限')
     }
     let sharers: PublicSharer[] = []

package/src/server/serverFns/knowledge/public/legal/list.ts

@@ -23,12 +23,15 @@ import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
 import { aggregateSharers } from '@/server/knowledge/public/share-merge'
 
+// 法规草稿的历史占位标题（早期创建表单未填标题时的默认值，当前代码已无写入点，
+// 仅存量数据可能命中）；列表默认隐藏这类半成品草稿（审计 ⚪：魔法字符串提为常量）
+const UNNAMED_LEGAL_TITLE = '未命名法规'
+
 const listSchema = z.object({
   scope: z.enum(['all', 'private', 'share', 'favorite']).default('all'),
   search: z.string().optional(),
   jurisdiction: z.string().optional(),
   category: z.string().optional(),
-  tags: z.array(z.string()).optional(),
   tag: z.string().optional(),
   sort: z.enum(['default', 'effectiveDate']).default('default'),
   page: z.number().int().min(1).default(1),
@@ -42,8 +45,8 @@ export const listLegalFn = createServerFn({ method: 'GET' })
     const request = getRequest()
     const session = await requireAuth(request)
     const where: Prisma.LegalRegulationWhereInput = { isDeleted: false }
-    where.NOT = { title: '未命名法规' }
-    const userId = session.user!.id!
+    where.NOT = { title: UNNAMED_LEGAL_TITLE }
+    const userId = session.user.id
     if (data.scope === 'private') {
       where.userId = userId
       where.visibility = 'private'