@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/plugins/harness-plugins.ts

@@ -19,20 +19,22 @@ import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
-import { getCurrentSession } from "@/lib/session";
-import { precheckPluginCode } from "./plugin-precheck";
-
-export interface PluginToolDef {
-  name: string;
-  description: string;
-  inputSchema: any;
-}
+import { requireAuth } from "@/server/auth-helpers";
+import { toJsonInput } from "@/server/lib/prisma-json";
+import {
+  precheckPluginCode,
+  PLUGIN_NAME_MAX,
+  PLUGIN_PURPOSE_MAX,
+  PLUGIN_CODE_MAX,
+  PLUGIN_TOOLS_MAX,
+  PLUGIN_TOOL_JSON_MAX,
+} from "./plugin-precheck";
 
 const upsertPluginSchema = z.object({
-  name: z.string().min(1).max(64),
-  purpose: z.string().min(1).max(512),
-  codeHost: z.string().max(64_000).optional(),
-  codeClient: z.string().max(64_000).optional(),
+  name: z.string().min(1).max(PLUGIN_NAME_MAX),
+  purpose: z.string().min(1).max(PLUGIN_PURPOSE_MAX),
+  codeHost: z.string().max(PLUGIN_CODE_MAX).optional(),
+  codeClient: z.string().max(PLUGIN_CODE_MAX).optional(),
 });
 
 const setPluginStatusSchema = z.object({
@@ -48,10 +50,12 @@ const setPluginToolsSchema = z.object({
       z.object({
         name: z.string(),
         description: z.string(),
-        inputSchema: z.any(),
+        // 审计 🟡（2026-10-25）：inputSchema 曾为 z.any() 无界入库；收敛为
+        // 对象形态（JSON Schema 即 Record）+ handler 内逐工具序列化体积上限
+        inputSchema: z.record(z.string(), z.unknown()),
       })
     )
-    .max(20),
+    .max(PLUGIN_TOOLS_MAX),
 });
 
 const deletePluginSchema = z.object({
@@ -62,8 +66,7 @@ export const listPluginsFn = createServerFn({ method: "GET" }).handler(
   async () => {
     const prisma = await getPrisma()
     const request = getRequest();
-    const session = await getCurrentSession(request);
-    if (!session?.user?.id) throw new Error("Unauthorized");
+    const session = await requireAuth(request);
     const userId = session.user.id;
 
     const plugins = await prisma.harnessPlugin.findMany({
@@ -92,8 +95,7 @@ export const upsertPluginFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    const session = await getCurrentSession(request);
-    if (!session?.user?.id) throw new Error("Unauthorized");
+    const session = await requireAuth(request);
     const userId = session.user.id;
 
     const precheck = precheckPluginCode(data);
@@ -144,8 +146,7 @@ export const setPluginStatusFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    const session = await getCurrentSession(request);
-    if (!session?.user?.id) throw new Error("Unauthorized");
+    const session = await requireAuth(request);
     const userId = session.user.id;
 
     // DB-03：属主校验合并进写入（updateMany 计数判定），1 次查询替代 findFirst+update 2 次
@@ -166,24 +167,29 @@ export const setPluginToolsFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    const session = await getCurrentSession(request);
-    if (!session?.user?.id) throw new Error("Unauthorized");
+    const session = await requireAuth(request);
     const userId = session.user.id;
 
     for (const tool of data.tools) {
       if (!tool.name || tool.name.trim().length === 0) {
         throw new Error("Tool name is required");
       }
+      // 审计 🟡（2026-10-25）：单工具序列化体积上限，防无界 JSON 入库（DoS 面）
+      if (JSON.stringify(tool.inputSchema ?? {}).length > PLUGIN_TOOL_JSON_MAX) {
+        throw new Error(`Tool inputSchema too large (max ${PLUGIN_TOOL_JSON_MAX} chars): ${tool.name}`);
+      }
     }
 
     // DB-03：属主校验合并进写入；工具名校验提前到查询前（单故障场景报错语义不变）
     const res = await prisma.harnessPlugin.updateMany({
       where: { id: data.id, userId, isDeleted: false },
-      data: { tools: data.tools as any },
+      data: { tools: toJsonInput(data.tools) },
     });
     if (res.count === 0) throw new Error("Plugin not found");
 
-    return { success: true, tools: data.tools };
+    // 审计 🟡（2026-10-25）：不再回显 tools——inputSchema 为 Record<string, unknown>，
+    // 无法通过 Start 返回值可序列化校验（原 as any 掩盖），且全仓无消费方
+    return { success: true };
   });
 
 export const deletePluginFn = createServerFn({ method: "POST" })
@@ -191,8 +197,7 @@ export const deletePluginFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    const session = await getCurrentSession(request);
-    if (!session?.user?.id) throw new Error("Unauthorized");
+    const session = await requireAuth(request);
     const userId = session.user.id;
 
     // DB-03：软删属主校验合并进写入（updateMany 计数判定）

package/src/server/serverFns/plugins/plugin-precheck.ts

@@ -15,6 +15,23 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+// 纯工具模块（无 createServerFn、零服务端依赖，客户端可安全导入——审计
+// serverFn 纯净性口径的 GRANDFATHERED 留守文件，勿在此新增服务端 import）。
+// harness-plugins.ts 的 upsertPluginSchema 与本文件共用同一组上限常量（审计 🔵：
+// 消除 64/512/64_000 两处硬编码漂移），ai-gateway/tools/plugin-lifecycle-server.ts
+// 也消费 precheckPluginCode。
+
+/** 插件名上限（字符）——zod schema 与 precheck 双层校验的单一来源 */
+export const PLUGIN_NAME_MAX = 64
+/** 用途描述上限（字符） */
+export const PLUGIN_PURPOSE_MAX = 512
+/** 单段代码（host/client）上限（字符） */
+export const PLUGIN_CODE_MAX = 64_000
+/** setPluginToolsFn 单插件工具数上限 */
+export const PLUGIN_TOOLS_MAX = 20
+/** 单工具 inputSchema 序列化后体积上限（字符），防无界 JSON 入库（DoS 面） */
+export const PLUGIN_TOOL_JSON_MAX = 32_000
+
 export interface PluginPrecheckInput {
   name: string;
   purpose: string;
@@ -34,14 +51,14 @@ export function precheckPluginCode(
 
   if (!input.name || input.name.trim().length === 0) {
     errors.push("name is required");
-  } else if (input.name.length > 64) {
-    errors.push("name must be at most 64 characters");
+  } else if (input.name.length > PLUGIN_NAME_MAX) {
+    errors.push(`name must be at most ${PLUGIN_NAME_MAX} characters`);
   }
 
   if (!input.purpose || input.purpose.trim().length === 0) {
     errors.push("purpose is required");
-  } else if (input.purpose.length > 512) {
-    errors.push("purpose must be at most 512 characters");
+  } else if (input.purpose.length > PLUGIN_PURPOSE_MAX) {
+    errors.push(`purpose must be at most ${PLUGIN_PURPOSE_MAX} characters`);
   }
 
   const hasHost = input.codeHost && input.codeHost.trim().length > 0;
@@ -51,28 +68,28 @@ export function precheckPluginCode(
     errors.push("at least one of codeHost or codeClient is required");
   }
 
-  if (hasHost) {
-    if (input.codeHost && input.codeHost.length > 64_000) {
-      errors.push("codeHost must be at most 64000 characters");
-    } else {
-      try {
-        new Function(input.codeHost as string);
-      } catch (e) {
-        errors.push(`codeHost syntax error: ${e instanceof Error ? e.message : String(e)}`);
-      }
+  // ⚠ SECURITY：new Function 在此仅【编译】用户代码做语法校验，绝不调用返回的
+  // 函数——调用即 RCE。后续维护者禁止把这里的返回值执行/导出；若需更强校验，
+  // 应引入独立 parser（如 acorn.parse），见审计明细 A2x-serverfns-5。
+  const syntaxCheck = (label: "codeHost" | "codeClient", code: string, max: number) => {
+    if (code.length > max) {
+      errors.push(`${label} must be at most ${max} characters`);
+      return;
+    }
+    try {
+      // eslint-disable-next-line no-new-func -- 仅编译校验语法，见上方 SECURITY 注释
+      new Function(code);
+    } catch (e) {
+      errors.push(`${label} syntax error: ${e instanceof Error ? e.message : String(e)}`);
     }
+  };
+
+  if (hasHost && input.codeHost) {
+    syntaxCheck("codeHost", input.codeHost, PLUGIN_CODE_MAX);
   }
 
-  if (hasClient) {
-    if (input.codeClient && input.codeClient.length > 64_000) {
-      errors.push("codeClient must be at most 64000 characters");
-    } else {
-      try {
-        new Function(input.codeClient as string);
-      } catch (e) {
-        errors.push(`codeClient syntax error: ${e instanceof Error ? e.message : String(e)}`);
-      }
-    }
+  if (hasClient && input.codeClient) {
+    syntaxCheck("codeClient", input.codeClient, PLUGIN_CODE_MAX);
   }
 
   return {

package/src/server/serverFns/project/module-overview.ts

@@ -20,6 +20,7 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
+import { assertProjectMembership } from "@/server/lib/project-membership";
 
 const projectIdSchema = z.object({ projectId: z.string().min(1) });
 
@@ -39,7 +40,8 @@ export const getModuleOverviewFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    await assertProjectMembership(data.projectId, session.user.id);
 
     const [storyAgg, prdLinks] = await Promise.all([
       prisma.story.aggregate({
@@ -62,7 +64,8 @@ export const getModuleOverviewFn = createServerFn({ method: "GET" })
           )
         : null;
 
-    // testcase / bug 暂无独立数据模型，真实空值
+    // TODO(testcase/bug/design 独立数据模型落地后替换)：design/testcase/bug 暂无
+    // 独立数据模型（design 已并入 PRD 关联口径），真实空值占位（审计 ⚪ 2026-10-25）
     return {
       requirement: {
         count: storyAgg._count._all,
@@ -83,7 +86,8 @@ export const listModuleStoriesFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    await assertProjectMembership(data.projectId, session.user.id);
     const stories = await prisma.story.findMany({
       where: { projectId: data.projectId, archived: false },
       orderBy: { updatedAt: "desc" },

package/src/server/serverFns/project.ts

@@ -25,18 +25,17 @@ import { validateDisplayId } from "@/lib/project-display-id";
 import { ensureBuiltinIndependentProject, migrateStoriesToIndependentProject } from "@/server/builtin-project";
 import { BUILTIN_INDEPENDENT_DISPLAY_ID, BUILTIN_INDEPENDENT_NAME, BUILTIN_INDEPENDENT_ICON } from "@/lib/builtin-project";
 import type { ProjectRole } from "@/types/project";
+import { USER_BRIEF_SELECT } from "@/server/lib/user-brief";
 import { startOfMonth, endOfMonth, subMonths, eachDayOfInterval } from "date-fns";
 import { formatInTimeZone } from "date-fns-tz";
 import type { Prisma } from "@allbluecn/database";
 
-// 用户精简信息 select
-const USER_BRIEF_SELECT = {
-  id: true,
-  username: true,
+// 成员列表专用：项目成员管理 UI 渲染并按 email 搜索成员（project-member-manager /
+// invite-member-dialog），属最小必要的 email 披露面；其余 owner/活动摘要一律走
+// 共享 USER_BRIEF_SELECT（不含 email，审计 ⚪ 最小披露，@/server/lib/user-brief 单一来源）
+const USER_BRIEF_SELECT_WITH_EMAIL = {
+  ...USER_BRIEF_SELECT,
   email: true,
-  avatarConfig: true,
-  bgShape: true,
-  bgColor: true,
 } satisfies Prisma.UserDefaultArgs["select"];
 
 // 权限校验：返回成员记录，无权限抛错
@@ -95,7 +94,7 @@ export const checkDisplayIdAvailableFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const formatError = validateDisplayId(data.displayId.toUpperCase());
     if (formatError) return { available: false, reason: formatError };
@@ -121,7 +120,7 @@ export const listProjectsFn = createServerFn({ method: "GET" }).handler(
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const memberships = await prisma.projectMember.findMany({
       where: { userId, status: { not: "suspended" } },
@@ -159,7 +158,7 @@ export const listProjectsBriefFn = createServerFn({ method: "GET" }).handler(
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await ensureBuiltinIndependentProject(userId);
 
@@ -193,7 +192,7 @@ export const createProjectFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const workspace = await prisma.workspace.findUnique({
       where: { id: data.workspaceId },
@@ -238,7 +237,7 @@ export const getProjectDetailFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireProjectMember(data.projectId, userId);
 
     const project = await prisma.project.findUnique({
@@ -280,7 +279,7 @@ export const updateProjectFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireProjectMember(data.projectId, userId, ["owner", "admin"]);
 
     const { projectId, displayId, ...rest } = data;
@@ -313,7 +312,7 @@ export const deleteProjectFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireProjectMember(data.projectId, userId, ["owner"]);
 
     const storyCount = await prisma.story.count({ where: { projectId: data.projectId } });
@@ -322,20 +321,24 @@ export const deleteProjectFn = createServerFn({ method: "POST" })
     }
 
     const mode = data.mode ?? "transfer";
-    if (storyCount > 0) {
-      if (mode === "clear") {
-        await prisma.story.deleteMany({ where: { projectId: data.projectId } });
-      } else {
-        const storyIds = (
-          await prisma.story.findMany({
-            where: { projectId: data.projectId },
-            select: { id: true },
-          })
-        ).map((s) => s.id);
-        await migrateStoriesToIndependentProject(userId, storyIds);
+    // 审计 🟡（2026-10-25）：迁移/清空 与 project.delete 收进单事务——旧实现
+    // 迁移成功而 delete 失败时需求已迁走、项目残留（半迁移态需人工修复）
+    await prisma.$transaction(async (tx) => {
+      if (storyCount > 0) {
+        if (mode === "clear") {
+          await tx.story.deleteMany({ where: { projectId: data.projectId } });
+        } else {
+          const storyIds = (
+            await tx.story.findMany({
+              where: { projectId: data.projectId },
+              select: { id: true },
+            })
+          ).map((s) => s.id);
+          await migrateStoriesToIndependentProject(userId, storyIds, tx);
+        }
       }
-    }
-    await prisma.project.delete({ where: { id: data.projectId } });
+      await tx.project.delete({ where: { id: data.projectId } });
+    });
     return { success: true };
   });
 
@@ -346,7 +349,7 @@ export const listProjectMembersFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireProjectMember(data.projectId, userId);
 
     const project = await prisma.project.findUnique({
@@ -371,7 +374,7 @@ export const listProjectMembersFn = createServerFn({ method: "GET" })
         role: true,
         status: true,
         joinedAt: true,
-        user: { select: USER_BRIEF_SELECT },
+        user: { select: USER_BRIEF_SELECT_WITH_EMAIL },
       },
     });
   });
@@ -389,7 +392,7 @@ export const addProjectMemberFromTeamFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const currentUserId = session.user!.id!;
+    const currentUserId = session.user.id;
     await requireProjectMember(data.projectId, currentUserId, ["owner", "admin"]);
 
     const project = await prisma.project.findUnique({
@@ -406,7 +409,7 @@ export const addProjectMemberFromTeamFn = createServerFn({ method: "POST" })
         where: { memberId: data.userId },
         select: { seatType: true, ownerId: true },
       });
-      if (!membership || (membership as { ownerId?: string }).ownerId !== project.ownerId) {
+      if (!membership || membership.ownerId !== project.ownerId) {
         throw new Error("仅可添加团队成员");
       }
       seatType = membership.seatType;
@@ -450,7 +453,7 @@ export const removeProjectMemberFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const currentUserId = session.user!.id!;
+    const currentUserId = session.user.id;
     const membership = await requireProjectMember(
       data.projectId,
       currentUserId,
@@ -492,7 +495,7 @@ export const updateMemberRoleFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const currentUserId = session.user!.id!;
+    const currentUserId = session.user.id;
     await requireProjectMember(data.projectId, currentUserId, ["owner"]);
 
     // SEC-04：按 projectId 收敛查找，防止跨项目 memberId 操作（IDOR）
@@ -530,7 +533,7 @@ export const listProjectActivitiesFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireProjectMember(data.projectId, userId);
 
     return prisma.projectActivity.findMany({
@@ -546,7 +549,9 @@ export const listProjectActivitiesFn = createServerFn({ method: "GET" })
         targetId: true,
         metadata: true,
         createdAt: true,
-        user: { select: USER_BRIEF_SELECT },
+        // ProjectActivity 消费方类型（ProjectUserBrief）含 email，activity 流
+        // 暂保留（收窄需同步改 components 的 ProjectActivity 契约，另行决策）
+        user: { select: USER_BRIEF_SELECT_WITH_EMAIL },
       },
     });
   });
@@ -563,7 +568,7 @@ export const getProjectActivityDataFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireProjectMember(data.projectId, userId);
 
     const timezone = data.timezone || "Asia/Shanghai";
@@ -601,7 +606,7 @@ export const ensureBuiltinProjectFn = createServerFn({ method: "GET" }).handler(
     const prisma = await getPrisma()
   const request = getRequest();
   const session = await requireAuth(request);
-  const userId = session.user!.id!;
+  const userId = session.user.id;
   const projectId = await ensureBuiltinIndependentProject(userId);
   return { id: projectId, name: BUILTIN_INDEPENDENT_NAME, displayId: BUILTIN_INDEPENDENT_DISPLAY_ID, icon: BUILTIN_INDEPENDENT_ICON };
 });
@@ -611,7 +616,9 @@ export const listProjectKbsFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    // 读侧成员校验（审计 2026-10-25：任意登录用户可枚举任意项目关联的知识库）
+    await requireProjectMember(data.projectId, session.user.id);
     const rows = await prisma.projectKnowledgeBase.findMany({
       where: { projectId: data.projectId },
       select: {
@@ -627,7 +634,9 @@ export const setProjectKbsFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    // 关联知识库改变项目全员可见范围：限 owner / admin（与其余项目级写路径口径一致）
+    await requireProjectMember(data.projectId, session.user.id, ["owner", "admin"]);
     if (data.kbIds.length > 0) {
       const valid = await prisma.knowledgeBase.findMany({
         where: { id: { in: data.kbIds }, visibility: "team", isDeleted: false },

package/src/server/serverFns/references/create.ts

@@ -19,6 +19,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { createReference } from '@/server/references/engine'
+import { assertEntityAccessible } from '@/server/references/access'
 import { requireAuth } from '@/server/auth-helpers'
 
 const createReferenceSchema = z.object({
@@ -27,14 +28,26 @@ const createReferenceSchema = z.object({
   targetModule: z.string().min(1),
   targetEntityId: z.string().min(1),
   entityType: z.string().optional(),
-  metadata: z.unknown().optional(),
+  // 审计 🟡（2026-10-25）：z.unknown() 无界透传；收敛为对象形态。
+  // 注意：Reference 表当前无 metadata 列，该字段仅作前向契约校验，不落库
+  metadata: z.record(z.string(), z.unknown()).optional(),
 })
 
 export const createReferenceFn = createServerFn({ method: 'POST' })
   .validator(createReferenceSchema)
   .handler(async ({ data }) => {
     const request = getRequest()
-    await requireAuth(request)
-    const ref = await createReference(data)
-    return ref
+    const session = await requireAuth(request)
+    const userId = session.user.id
+    // 审计 🟠（2026-10-25）：engine 无属主校验，source/target 须逐一断言归属
+    await assertEntityAccessible(userId, data.sourceModule, data.sourceEntityId, data.entityType)
+    await assertEntityAccessible(userId, data.targetModule, data.targetEntityId, data.entityType)
+    // 仅透传 Reference 表真实存在的列（entityType/metadata 非表列，直传会
+    // PrismaClientValidationError 500）
+    return createReference({
+      sourceModule: data.sourceModule,
+      sourceEntityId: data.sourceEntityId,
+      targetModule: data.targetModule,
+      targetEntityId: data.targetEntityId,
+    })
   })

package/src/server/serverFns/references/resolve.ts

@@ -19,6 +19,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { resolveReferences } from '@/server/references/engine'
+import { assertEntityAccessible, filterAccessibleRefs } from '@/server/references/access'
 import { requireAuth } from '@/server/auth-helpers'
 
 const schema = z.object({
@@ -30,7 +31,14 @@ export const resolveReferencesFn = createServerFn({ method: 'POST' })
   .validator(schema)
   .handler(async ({ data }) => {
     const request = getRequest()
-    await requireAuth(request)
+    const session = await requireAuth(request)
+    const userId = session.user.id
+    // 审计 🟠（2026-10-25）：engine 无属主过滤——先断言 source 归属，再过滤
+    // target 不可访问（他人/未登记模块）的引用行，防跨用户枚举
+    await assertEntityAccessible(userId, data.sourceModule, data.sourceEntityId)
     const results = await resolveReferences(data.sourceModule, data.sourceEntityId)
-    return results
+    return filterAccessibleRefs(
+      userId,
+      results.map((r) => ({ ...r, module: r.targetModule, entityId: r.targetEntityId })),
+    )
   })

package/src/server/serverFns/references/search.ts

@@ -19,6 +19,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { searchReferences } from '@/server/references/engine'
+import { filterAccessibleRefs } from '@/server/references/access'
 import { requireAuth } from '@/server/auth-helpers'
 
 const schema = z.object({
@@ -30,8 +31,14 @@ export const searchReferencesFn = createServerFn({ method: 'POST' })
   .validator(schema)
   .handler(async ({ data }) => {
     const request = getRequest()
-    await requireAuth(request)
+    const session = await requireAuth(request)
+    const userId = session.user.id
     const types = data.types?.split(',').filter(Boolean)
     const results = await searchReferences(data.q, types)
-    return results
+    // 审计 🟠（2026-10-25）：engine 为全局索引（无用户/项目维度），按结果行
+    // 逐一收敛到当前用户可访问实体，防关键词全站枚举
+    return filterAccessibleRefs(
+      userId,
+      results.map((r) => ({ ...r, entityId: r.id })),
+    )
   })

package/src/server/serverFns/settings/account-team.ts

@@ -60,7 +60,7 @@ export const getAccountTeamFn = createServerFn({ method: 'GET' })
         id: session.user.id,
         name: dbUser?.username || session.user.name,
         email: dbUser?.email || session.user.email,
-        role: (session.user as { role?: string })?.role,
+        role: session.user.role ?? undefined,
         createdAt: dbUser?.createdAt ?? null,
       },
     }

package/src/server/serverFns/share/design/[designId]/events.ts

@@ -19,15 +19,20 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
+import { assertDesignReadable } from '@/server/design/access'
 
 const schema = z.object({
   designId: z.string(),
 })
 
+// ⚠ 占位实现（事件订阅通道未落地，当前无消费方）：仅校验 designId 对调用者
+// 可读（属主或存在有效分享），防对任意/不存在 designId 恒返回已订阅的假契约
+// （审计 🟡 2026-10-25）。真实事件推送落地时须替换为实际订阅语义并重命名。
 export const shareEventsFn = createServerFn({ method: 'GET' })
   .validator(schema)
   .handler(async ({ data }) => {
     const request = getRequest()
-    await requireAuth(request)
+    const session = await requireAuth(request)
+    await assertDesignReadable(data.designId, session.user.id)
     return { designId: data.designId, subscribed: true }
   })