@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/knowledge.ts

@@ -28,6 +28,8 @@ import { getVectorStore } from '@/lib/vector-store'
 import { requirePermission } from '@/server/permissions'
 import { auditLog } from '@/server/audit'
 import { assertOwned } from '@/server/lib/ownership'
+import { assertProjectsMembership } from '@/server/lib/project-membership'
+import { USER_BRIEF_SELECT } from '@/server/lib/user-brief'
 import { withCollabGuard } from '@/server/collab/write-guard'
 import { touchCollabSnapshot } from '@/server/collab/touch-snapshot'
 
@@ -44,7 +46,7 @@ export const listKnowledgeFn = createServerFn({ method: 'GET' })
     const request = getRequest()
     const session = await requireAuth(request)
     return prisma.knowledgeBase.findMany({
-      where: { userId: session.user!.id!, isDeleted: false },
+      where: { userId: session.user.id, isDeleted: false },
       orderBy: [{ pinnedToSidebar: 'desc' }, { createdAt: 'asc' }],
       select: {
         id: true,
@@ -74,7 +76,7 @@ export const createKnowledgeFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     await requirePermission(userId, 'knowledge', 'write')
     const kb = await prisma.$transaction(async (tx) => {
       const knowledge = await tx.knowledgeBase.create({
@@ -111,7 +113,7 @@ export const getKnowledgeDetailFn = createServerFn({ method: 'GET' })
     const request = getRequest()
     const session = await requireAuth(request)
     const kb = await prisma.knowledgeBase.findFirst({
-      where: { id: data.id, ...READABLE_KB(session.user!.id!) },
+      where: { id: data.id, ...READABLE_KB(session.user.id) },
       select: { id: true, name: true, description: true, icon: true, tags: true, visibility: true, createdAt: true, updatedAt: true },
     })
     if (!kb) throw new Error('未找到或无权限')
@@ -126,7 +128,7 @@ export const deleteKnowledgeFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     await requirePermission(userId, 'knowledge', 'write')
     // DB-03：属主校验合并进软删（updateMany 计数判定），1 次查询替代 2 次并消除 TOCTOU。
     // DB-07：审计经 pro-service 独立连接（OSS 为 no-op）且自带 try/catch best-effort 语义，
@@ -155,7 +157,7 @@ export const updateKnowledgeFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     await requirePermission(userId, 'knowledge', 'write')
     // DB-03：属主校验合并进写入（updateManyAndReturn 单查询返回更新行）
     const rows = await prisma.knowledgeBase.updateManyAndReturn({
@@ -180,8 +182,10 @@ export const listDocumentsFn = createServerFn({ method: 'GET' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
+    // 读口径与 createDocumentFn（READABLE_KB）统一（审计 2026-10-25 🟠）：
+    // 在他人 team/general KB 里建的文档必须能被列出，否则协作链路断裂
     const kb = await prisma.knowledgeBase.findFirst({
-      where: { id: data.kbId, userId: session.user!.id!, isDeleted: false },
+      where: { id: data.kbId, ...READABLE_KB(session.user.id) },
       select: { id: true },
     })
     if (!kb) throw new Error('未找到或无权限')
@@ -217,29 +221,41 @@ export const createDocumentFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     await requirePermission(userId, 'knowledge', 'write')
     const kb = await prisma.knowledgeBase.findFirst({
-      where: { id: data.kbId, ...READABLE_KB(session.user!.id!) },
+      where: { id: data.kbId, ...READABLE_KB(session.user.id) },
       select: { id: true },
     })
     if (!kb) throw new Error('未找到或无权限')
-    const maxSort = await prisma.knowledgeDocument.aggregate({
-      where: { kbId: data.kbId, parentId: data.parentId || null, isDeleted: false },
-      _max: { sortOrder: true },
-    })
-    const nextSort = (maxSort._max.sortOrder ?? -1) + 1
-    const doc = await prisma.knowledgeDocument.create({
-      data: {
-        kbId: data.kbId,
-        parentId: data.parentId || null,
-        title: data.title,
-        type: data.type,
-        sortOrder: nextSort,
-        properties: {},
-        createdBy: userId,
-      },
-      select: { id: true, title: true, type: true, parentId: true },
+    // parentId 必须存在且属于同一 KB（审计 2026-10-25：防把文档挂到他人 KB 节点下）
+    if (data.parentId) {
+      const parent = await prisma.knowledgeDocument.findFirst({
+        where: { id: data.parentId, kbId: data.kbId, isDeleted: false },
+        select: { id: true },
+      })
+      if (!parent) throw new Error('父文档不存在')
+    }
+    // maxSort 聚合与创建同事务（审计 2026-10-25：收窄 check-then-act 竞态窗口；
+    // 默认隔离级下极端并发仍可能重复 sortOrder，展示层按序稳定即可容忍）
+    const doc = await prisma.$transaction(async (tx) => {
+      const maxSort = await tx.knowledgeDocument.aggregate({
+        where: { kbId: data.kbId, parentId: data.parentId || null, isDeleted: false },
+        _max: { sortOrder: true },
+      })
+      const nextSort = (maxSort._max.sortOrder ?? -1) + 1
+      return tx.knowledgeDocument.create({
+        data: {
+          kbId: data.kbId,
+          parentId: data.parentId || null,
+          title: data.title,
+          type: data.type,
+          sortOrder: nextSort,
+          properties: {},
+          createdBy: userId,
+        },
+        select: { id: true, title: true, type: true, parentId: true },
+      })
     })
     await auditLog({ workspaceId: '', userId, resourceType: 'document', resourceId: doc.id, action: 'document.create' })
     return doc
@@ -257,7 +273,8 @@ export const getDocumentFn = createServerFn({ method: 'GET' })
       where: {
         id: data.id,
         isDeleted: false,
-        kb: { userId: session.user!.id!, isDeleted: false },
+        // 读口径与 createDocumentFn（READABLE_KB）统一（审计 2026-10-25 🟠）
+        kb: READABLE_KB(session.user.id),
       },
       select: {
         id: true,
@@ -272,29 +289,46 @@ export const getDocumentFn = createServerFn({ method: 'GET' })
         properties: true,
         createdAt: true,
         updatedAt: true,
-        creator: {
-          select: {
-            id: true,
-            username: true,
-            avatarConfig: true,
-            bgShape: true,
-            bgColor: true,
-          },
-        },
+        creator: { select: USER_BRIEF_SELECT },
       },
     })
     if (!doc) throw new Error('未找到或无权限')
     return doc
   })
 
-const updateDocSchema = z.object({
-  id: z.string(),
-  title: z.string().min(1).max(100).optional(),
-  content: z.any().optional(),
-  icon: z.string().optional(),
-  tags: z.array(z.string()).optional(),
-  properties: z.record(z.string(), z.any()).optional(),
-})
+// 文档 content / properties 为 Json 列，形状随编辑器演进（TipTap JSON / markdown /
+// 表格配置），不做结构收敛；仅加序列化体积上限防超大 JSON 写库（审计 2026-10-25）。
+// 注意：字段类型保持 z.any()（推断 any）而非 z.unknown()——content 会回显进
+// updateDocumentFn 返回值，unknown 过不了 serverFn 的 TSerializable 序列化校验。
+const MAX_DOC_CONTENT_JSON_CHARS = 2_000_000
+const MAX_DOC_PROPERTIES_JSON_CHARS = 256_000
+
+function jsonSizeOk(value: unknown, max: number): boolean {
+  if (value === undefined || value === null) return true
+  try {
+    return JSON.stringify(value).length <= max
+  } catch {
+    return false
+  }
+}
+
+const updateDocSchema = z
+  .object({
+    id: z.string(),
+    title: z.string().min(1).max(100).optional(),
+    content: z.any().optional(),
+    icon: z.string().optional(),
+    tags: z.array(z.string()).optional(),
+    properties: z.record(z.string(), z.any()).optional(),
+  })
+  .refine((d) => jsonSizeOk(d.content, MAX_DOC_CONTENT_JSON_CHARS), {
+    message: '文档内容过大',
+    path: ['content'],
+  })
+  .refine((d) => jsonSizeOk(d.properties, MAX_DOC_PROPERTIES_JSON_CHARS), {
+    message: '文档属性过大',
+    path: ['properties'],
+  })
 
 export const updateDocumentFn = createServerFn({ method: 'POST' })
   .validator(updateDocSchema)
@@ -302,7 +336,7 @@ export const updateDocumentFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     await requirePermission(userId, 'knowledge', 'write')
     // ── Yjs 多人协作 §5.3 写入门卫（任务 17）：CollabDocument 存在且 patch 含
     // content → 一律转发 collab 内部通道（room 活跃判定在 collab 侧：在线应用
@@ -449,7 +483,7 @@ export const deleteDocumentFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     await requirePermission(userId, 'knowledge', 'write')
     // 首页判定需回读行字段（isHomepage），属主校验走单查询 findFirst（行复用）
     const doc = await assertOwned(
@@ -479,7 +513,15 @@ export const deleteDocumentFn = createServerFn({ method: 'POST' })
       }),
     ])
     const store = await getVectorStore()
-    store.deleteEmbeddings("knowledge_embeddings", "documentId", data.id).catch(() => {})
+    // fire-and-forget：向量清理失败不阻塞软删，但不静默（与 updateDocumentFn 口径
+    // 一致）；表名统一走 KB_EMBEDDINGS_TABLE 常量（审计 2026-10-25：此处曾硬编码）
+    store
+      .deleteEmbeddings(KB_EMBEDDINGS_TABLE, "documentId", data.id)
+      .catch((e: unknown) => {
+        console.warn(
+          `文档向量清理失败 documentId=${data.id}: ${e instanceof Error ? e.message : String(e)}`,
+        )
+      })
     await auditLog({ workspaceId: '', userId, resourceType: 'document', resourceId: data.id, action: 'document.delete' })
     return { success: true }
   })
@@ -490,8 +532,9 @@ export const getHomepageDocumentFn = createServerFn({ method: 'GET' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
+    // 读口径与 createDocumentFn（READABLE_KB）统一（审计 2026-10-25 🟠）
     const kb = await prisma.knowledgeBase.findFirst({
-      where: { id: data.kbId, userId: session.user!.id!, isDeleted: false },
+      where: { id: data.kbId, ...READABLE_KB(session.user.id) },
       select: { id: true },
     })
     if (!kb) throw new Error('未找到或无权限')
@@ -507,8 +550,9 @@ export const getDocBreadcrumbFn = createServerFn({ method: 'GET' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
+    // 读口径与 createDocumentFn（READABLE_KB）统一（审计 2026-10-25 🟠）
     const kb = await prisma.knowledgeBase.findFirst({
-      where: { id: data.kbId, userId: session.user!.id!, isDeleted: false },
+      where: { id: data.kbId, ...READABLE_KB(session.user.id) },
       select: { id: true },
     })
     if (!kb) throw new Error('未找到或无权限')
@@ -554,19 +598,30 @@ export const getDocBreadcrumbFn = createServerFn({ method: 'GET' })
     return items
   })
 
+/** 公共域搜索配置（审计 2026-10-25 ⚪：替代 groupName 三元映射——新增公共域只加一行） */
+const PUBLIC_SEARCH_DOMAINS = [
+  { table: 'legalRegulation', entityType: 'legal', label: '法律法规' },
+  { table: 'industryCompliance', entityType: 'compliance', label: '行业合规' },
+  { table: 'dictionaryTerm', entityType: 'dictionary', label: '词典词条' },
+  { table: 'websiteBookmark', entityType: 'bookmark', label: '网站收藏' },
+] as const
+
+/** 嵌入行 id 约定为 `${documentId}-${chunkIndex}`（knowledge-index-utils
+ * indexDocumentEmbeddings 写入），chunkIndex 可为多位数字，取最后一个 "-" 前缀。 */
+function documentIdFromEmbeddingRowId(rowId: string): string {
+  const cut = rowId.lastIndexOf('-')
+  return cut > 0 ? rowId.slice(0, cut) : rowId
+}
+
 const searchPublicKnowledge = async (
-  table: 'legalRegulation' | 'industryCompliance' | 'dictionaryTerm' | 'websiteBookmark',
+  domain: (typeof PUBLIC_SEARCH_DOMAINS)[number],
   userId: string,
   query: string,
-  groupName: string,
 ): Promise<Array<{ id: string; title: string; kbId: string; kbName: string; type: string; icon: null; group: string }>> => {
   const prisma = await getPrisma()
   const favoriteIds = await prisma.articleFavorite
     .findMany({
-      where: {
-        entityType: groupName === '法律法规' ? 'legal' : groupName === '行业合规' ? 'compliance' : groupName === '词典词条' ? 'dictionary' : 'bookmark',
-        userId,
-      },
+      where: { entityType: domain.entityType, userId },
       select: { entityId: true },
     })
     .then((r) => new Set(r.map((f) => f.entityId)))
@@ -580,7 +635,10 @@ const searchPublicKnowledge = async (
     ],
   }
 
-  const items = await (prisma[table] as unknown as { findMany: (args: Record<string, unknown>) => Promise<Array<{ id: string; title: string }>> }).findMany({
+  // 四表 delegate 无公共基类，动态分发收窄为只用的 findMany 操作面
+  const items = await (prisma[domain.table] as unknown as {
+    findMany: (args: Record<string, unknown>) => Promise<Array<{ id: string; title: string }>>
+  }).findMany({
     where,
     orderBy: { updatedAt: 'desc' },
     select: { id: true, title: true },
@@ -590,11 +648,11 @@ const searchPublicKnowledge = async (
   return items.map((item) => ({
     id: item.id,
     title: item.title,
-    kbId: groupName,
-    kbName: groupName,
+    kbId: domain.label,
+    kbName: domain.label,
     type: 'doc',
     icon: null,
-    group: groupName,
+    group: domain.label,
   }))
 }
 
@@ -604,7 +662,7 @@ export const searchDocumentsFn = createServerFn({ method: 'GET' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     const { query, currentKbId } = data
 
     const kbs = await prisma.knowledgeBase.findMany({
@@ -615,8 +673,13 @@ export const searchDocumentsFn = createServerFn({ method: 'GET' })
 
     let kbDocs: Array<{ id: string; title: string; kbId: string; type: string; icon: string | null }>
 
+    // currentKbId 仅在属于本人 KB 时用于取 AI 配置（审计 2026-10-25 🟡：
+    // resolveAiConfig 按 kbId 取 KB 属主的 key——不校验则可借他人 KB 的 API key
+    // 为自己的查询计费）。非本人 KB 一律回落自己的第一个 KB。
+    const kbIdForAi = currentKbId && kbIds.includes(currentKbId) ? currentKbId : kbs[0]?.id || ""
+
     try {
-      const aiConfig = await resolveAiConfig(currentKbId || kbs[0]?.id || "")
+      const aiConfig = await resolveAiConfig(kbIdForAi)
       if (!aiConfig.apiKey) throw new Error("no api key")
 
       const queryVector = await generateEmbedding(query, aiConfig)
@@ -628,7 +691,7 @@ export const searchDocumentsFn = createServerFn({ method: 'GET' })
 
       const reranked = (await rerankCandidates(query, candidates, 10, { apiKey: aiConfig.apiKey })) ?? candidates
 
-      const docIds = [...new Set(reranked.map((r) => r.id.substring(0, r.id.lastIndexOf("-"))))].slice(0, 10)
+      const docIds = [...new Set(reranked.map((r) => documentIdFromEmbeddingRowId(r.id)))].slice(0, 10)
 
       kbDocs = await prisma.knowledgeDocument.findMany({
         where: { id: { in: docIds }, isDeleted: false, isHomepage: false },
@@ -637,7 +700,11 @@ export const searchDocumentsFn = createServerFn({ method: 'GET' })
 
       const orderMap = new Map(docIds.map((id, i) => [id, i]))
       kbDocs.sort((a, b) => (orderMap.get(a.id) ?? 999) - (orderMap.get(b.id) ?? 999))
-    } catch {
+    } catch (e: unknown) {
+      // 降级不再静默（审计 2026-10-25：检索链路失效需可排查）
+      console.warn(
+        `知识库向量检索降级为文本匹配 userId=${userId}: ${e instanceof Error ? e.message : String(e)}`,
+      )
       kbDocs = await prisma.knowledgeDocument.findMany({
         where: {
           kbId: { in: kbIds },
@@ -652,10 +719,10 @@ export const searchDocumentsFn = createServerFn({ method: 'GET' })
     }
 
     const [legalDocs, complianceDocs, dictionaryDocs, bookmarkDocs] = await Promise.all([
-      searchPublicKnowledge('legalRegulation', userId, query, '法律法规'),
-      searchPublicKnowledge('industryCompliance', userId, query, '行业合规'),
-      searchPublicKnowledge('dictionaryTerm', userId, query, '词典词条'),
-      searchPublicKnowledge('websiteBookmark', userId, query, '网站收藏'),
+      searchPublicKnowledge(PUBLIC_SEARCH_DOMAINS[0], userId, query),
+      searchPublicKnowledge(PUBLIC_SEARCH_DOMAINS[1], userId, query),
+      searchPublicKnowledge(PUBLIC_SEARCH_DOMAINS[2], userId, query),
+      searchPublicKnowledge(PUBLIC_SEARCH_DOMAINS[3], userId, query),
     ])
 
     const kbMap = new Map(kbs.map((k) => [k.id, k.name]))
@@ -675,111 +742,17 @@ export const searchDocumentsFn = createServerFn({ method: 'GET' })
     ]
   })
 
-export interface DocumentPreviewData {
-  id: string
-  title: string
-  content: string
-  type: string
-  icon: string | null
-  updatedAt: string
-  creator: {
-    username: string | null
-    avatarConfig: unknown
-    bgShape: string | null
-    bgColor: string | null
-  } | null
-}
-
-export const getDocumentPreviewFn = createServerFn({ method: 'GET' })
-  .validator(z.object({
-    docId: z.string(),
-    docGroup: z.string().optional(),
-  }))
-  .handler(async ({ data }) => {
-    const prisma = await getPrisma()
-    const request = getRequest()
-    const session = await requireAuth(request)
-    const userId = session.user!.id!
-    const { docId, docGroup } = data
-
-    const PUBLIC_TABLES = ['法律法规', '行业合规', '词典词条', '网站收藏'] as const
-    const isPublic = docGroup && PUBLIC_TABLES.includes(docGroup as typeof PUBLIC_TABLES[number])
-
-    if (isPublic) {
-      const tableMap = {
-        '法律法规': 'legalRegulation',
-        '行业合规': 'industryCompliance',
-        '词典词条': 'dictionaryTerm',
-        '网站收藏': 'websiteBookmark',
-      } as const
-      const table = tableMap[docGroup as keyof typeof tableMap]
-      const item = await (prisma[table] as unknown as {
-        findUnique: (args: { where: { id: string }; select: Record<string, boolean> }) => Promise<{
-          id: string; title: string; content: unknown; updatedAt: Date; userId: string
-        } | null>
-      }).findUnique({
-        where: { id: docId },
-        select: { id: true, title: true, content: true, updatedAt: true, userId: true },
-      })
-      if (!item) return null
-
-      const creator = await prisma.user.findUnique({
-        where: { id: item.userId },
-        select: { username: true, avatarConfig: true, bgShape: true, bgColor: true },
-      })
-
-      return {
-        id: item.id,
-        title: item.title,
-        content: typeof item.content === 'string' ? item.content : JSON.stringify(item.content ?? ''),
-        type: 'doc',
-        icon: null,
-        updatedAt: item.updatedAt.toISOString(),
-        creator: creator ? {
-          username: creator.username,
-          avatarConfig: creator.avatarConfig,
-          bgShape: creator.bgShape,
-          bgColor: creator.bgColor,
-        } : null,
-      } satisfies DocumentPreviewData
-    }
-
-    const doc = await prisma.knowledgeDocument.findUnique({
-      where: { id: docId },
-      select: {
-        id: true, title: true, content: true, type: true, icon: true,
-        updatedAt: true, createdBy: true, isDeleted: true,
-      },
-    })
-    if (!doc || doc.isDeleted) return null
-
-    const creator = await prisma.user.findUnique({
-      where: { id: doc.createdBy },
-      select: { username: true, avatarConfig: true, bgShape: true, bgColor: true },
-    })
-
-    return {
-      id: doc.id,
-      title: doc.title,
-      content: typeof doc.content === 'string' ? doc.content : JSON.stringify(doc.content ?? ''),
-      type: doc.type,
-      icon: doc.icon,
-      updatedAt: doc.updatedAt.toISOString(),
-      creator: creator ? {
-        username: creator.username,
-        avatarConfig: creator.avatarConfig,
-        bgShape: creator.bgShape,
-        bgColor: creator.bgColor,
-      } : null,
-    } satisfies DocumentPreviewData
-  })
-
 export const listKbProjectsFn = createServerFn({ method: 'GET' })
   .validator(z.object({ kbId: z.string() }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
+    await assertOwned(
+      prisma.knowledgeBase,
+      { where: { id: data.kbId, ...READABLE_KB(session.user.id) }, select: { id: true } },
+      '知识库不存在',
+    )
     const rows = await prisma.projectKnowledgeBase.findMany({
       where: { kbId: data.kbId },
       select: { project: { select: { id: true, name: true, icon: true } } },
@@ -794,7 +767,9 @@ export const setKbProjectsFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
+    // 与其他知识库写路径同口径（审计 2026-10-25：其他写路径均有，此处曾漏）
+    await requirePermission(userId, 'knowledge', 'write')
     const kb = await prisma.knowledgeBase.findFirst({
       where: { id: data.kbId, userId, isDeleted: false },
       select: { visibility: true },
@@ -802,6 +777,8 @@ export const setKbProjectsFn = createServerFn({ method: 'POST' })
     if (!kb) throw new Error('知识库不存在')
     if (kb.visibility === 'general') throw new Error('通用知识库对所有项目可见，无需关联')
     if (kb.visibility === 'private') throw new Error('私有知识库不可关联项目，请先切换为团队可见')
+    // 关联即向该项目全员开放 KB 内容：只能关联自己是有效成员的项目
+    await assertProjectsMembership(data.projectIds, userId, '无权限关联该项目')
     await prisma.$transaction(async (tx) => {
       await tx.projectKnowledgeBase.deleteMany({
         where: { kbId: data.kbId, projectId: { notIn: data.projectIds } },
@@ -827,7 +804,7 @@ export const toggleKnowledgePinFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     // DB-03：属主校验合并进写入（updateManyAndReturn 单查询返回更新行）
     const rows = await prisma.knowledgeBase.updateManyAndReturn({
       where: { id: data.kbId, userId, isDeleted: false },

package/src/server/serverFns/notifications.ts

@@ -32,19 +32,26 @@ export const listNotificationsFn = createServerFn({ method: 'GET' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
 
-    const items = await prisma.notification.findMany({
-      where: {
-        userId,
-        ...(data.category ? { category: data.category } : {}),
-        ...(data.status === 'unread' ? { readAt: null } : {}),
-        ...(data.status === 'read' ? { readAt: { not: null } } : {}),
-      },
-      orderBy: { createdAt: 'desc' },
-      take: PAGE_SIZE + 1,
-      ...(data.cursor ? { cursor: { id: data.cursor }, skip: 1 } : {}),
-    })
+    const where = {
+      userId,
+      ...(data.category ? { category: data.category } : {}),
+      ...(data.status === 'unread' ? { readAt: null } : {}),
+      ...(data.status === 'read' ? { readAt: { not: null } } : {}),
+    }
+
+    const [items, total] = await Promise.all([
+      prisma.notification.findMany({
+        where,
+        orderBy: { createdAt: 'desc' },
+        take: PAGE_SIZE + 1,
+        ...(data.cursor ? { cursor: { id: data.cursor }, skip: 1 } : {}),
+      }),
+      // 审计 🟡（2026-10-25）：total 契约语义是「过滤条件下的真实总数」，
+      // 旧实现返回 page.length（≤20）；count 与取页使用同一 where 并行
+      prisma.notification.count({ where }),
+    ])
 
     const hasMore = items.length > PAGE_SIZE
     const page = (hasMore ? items.slice(0, PAGE_SIZE) : items).map(
@@ -59,7 +66,7 @@ export const listNotificationsFn = createServerFn({ method: 'GET' })
         createdAt: n.createdAt.toISOString(),
       }),
     )
-    return { items: page, total: page.length, hasMore }
+    return { items: page, total, hasMore }
   })
 
 const markReadSchema = z.object({ id: z.string().min(1) })
@@ -70,7 +77,7 @@ export const markNotificationReadFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     await prisma.notification.updateMany({
       where: { id: data.id, userId, readAt: null },
       data: { readAt: new Date() },
@@ -84,7 +91,7 @@ export const markAllNotificationsReadFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     const result = await prisma.notification.updateMany({
       where: { userId, readAt: null },
       data: { readAt: new Date() },
@@ -100,7 +107,7 @@ export const deleteNotificationFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     await prisma.notification.deleteMany({ where: { id: data.id, userId } })
     return { success: true }
   })
@@ -111,7 +118,7 @@ export const clearNotificationsFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     const result = await prisma.notification.deleteMany({ where: { userId } })
     return { success: true, count: result.count }
   })
@@ -122,7 +129,7 @@ export const getUnreadCountFn = createServerFn({ method: 'GET' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     const count = await prisma.notification.count({
       where: { userId, readAt: null },
     })
@@ -135,7 +142,7 @@ export const getNotificationPreferencesFn = createServerFn({ method: 'GET' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    return getOrCreatePreferences(session.user!.id!)
+    return getOrCreatePreferences(session.user.id)
   })
 
 const preferencesSchema = z.object({
@@ -145,8 +152,9 @@ const preferencesSchema = z.object({
     .record(z.enum(NOTIFICATION_CATEGORIES), z.boolean())
     .optional(),
   dndEnabled: z.boolean(),
-  dndStart: z.string().regex(/^\d{2}:\d{2}$/),
-  dndEnd: z.string().regex(/^\d{2}:\d{2}$/),
+  // 严格 24 小时制 HH:MM（审计 🟡：旧 ^\d{2}:\d{2}$ 放行 99:99/25:70 等非法时间）
+  dndStart: z.string().regex(/^(?:[01]\d|2[0-3]):[0-5]\d$/),
+  dndEnd: z.string().regex(/^(?:[01]\d|2[0-3]):[0-5]\d$/),
 })
 
 export const updateNotificationPreferencesFn = createServerFn({
@@ -157,7 +165,7 @@ export const updateNotificationPreferencesFn = createServerFn({
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     const categories = { ...DEFAULT_CATEGORIES } as CategoryFrequencies
     for (const c of NOTIFICATION_CATEGORIES) {
       const v = data.categories[c]