@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/share/version.ts

@@ -18,6 +18,7 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
+import { shareGatePassed } from '@/server/design/share-access'
 
 interface ShareVersionData {
   prdName: string
@@ -36,6 +37,41 @@ interface ShareVersionData {
   }>
 }
 
+// 审计 🟡（2026-10-25）：存量 pageVersions JSON 曾直接双重 as 断言下发，畸形
+// 行（缺 pageId / canvas 非法 / content 非 string）会打到分享页运行时。改为
+// 逐行校验清洗：非对象行 / 缺 pageId 的行丢弃，canvas 兼容旧数组格式，其余
+// 字段回退安全值——降级而非 500。
+function sanitizePageVersions(raw: unknown): ShareVersionData['pageVersions'] {
+  if (!Array.isArray(raw)) return []
+  const out: ShareVersionData['pageVersions'] = []
+  for (const item of raw) {
+    if (typeof item !== 'object' || item === null) continue
+    const o = item as Record<string, unknown>
+    if (typeof o.pageId !== 'string' || o.pageId.length === 0) continue
+    const canvas = (() => {
+      if (Array.isArray(o.canvas)) {
+        return { elements: o.canvas, device: 'desktop' } as ShareVersionData['pageVersions'][number]['canvas']
+      }
+      if (
+        typeof o.canvas === 'object' &&
+        o.canvas !== null &&
+        Array.isArray((o.canvas as { elements?: unknown }).elements)
+      ) {
+        return o.canvas as ShareVersionData['pageVersions'][number]['canvas']
+      }
+      return null
+    })()
+    out.push({
+      pageId: o.pageId,
+      pageName: typeof o.pageName === 'string' ? o.pageName : '',
+      version: typeof o.version === 'number' && Number.isFinite(o.version) ? o.version : 1,
+      canvas,
+      content: typeof o.content === 'string' ? o.content : null,
+    })
+  }
+  return out
+}
+
 export const getVersionShareFn = createServerFn({ method: 'GET' })
   .validator(z.object({ versionId: z.string() }))
   .handler(async ({ data: { versionId } }): Promise<ShareVersionData | null> => {
@@ -44,7 +80,8 @@ export const getVersionShareFn = createServerFn({ method: 'GET' })
     // SEC-18: 越权读防护——version 必须经 ShareVersion 关联到一个有效分享
     // （status=ACTIVE 且未过期，主分享 prd / 单独分享 prd_single 均可）。
     // 公开访问语义不变：不强制登录，无有效 share 返回 null → 路由层 404。
-    const shareVersion = await prisma.shareVersion.findFirst({
+    // 有密码的分享还须持有效访问凭证（shareGatePassed）——否则密码门可被 RPC 直连绕过。
+    const shareVersions = await prisma.shareVersion.findMany({
       where: {
         versionId,
         share: {
@@ -52,8 +89,12 @@ export const getVersionShareFn = createServerFn({ method: 'GET' })
           OR: [{ expiresAt: null }, { expiresAt: { gt: new Date() } }],
         },
       },
-      select: { id: true, share: { select: { token: true, designId: true } } },
+      select: {
+        id: true,
+        share: { select: { id: true, hasPassword: true, token: true, designId: true } },
+      },
     })
+    const shareVersion = shareVersions.find((sv) => shareGatePassed(sv.share))
     if (!shareVersion) return null
 
     const version = await prisma.designVersion.findUnique({
@@ -67,20 +108,7 @@ export const getVersionShareFn = createServerFn({ method: 'GET' })
     })
     if (!version) return null
 
-    const rawPageVersions = version.pageVersions as unknown as Array<{
-      pageId: string
-      pageName: string
-      version: number
-      canvas: unknown[] | { elements: unknown[]; device: string } | null
-      content: unknown
-    }>
-
-    const pageVersions = rawPageVersions.map((pv) => ({
-      ...pv,
-      canvas: Array.isArray(pv.canvas)
-        ? { elements: pv.canvas, device: 'desktop' }
-        : pv.canvas,
-    })) as ShareVersionData['pageVersions']
+    const pageVersions = sanitizePageVersions(version.pageVersions)
 
     return {
       prdName: version.design.name,

package/src/server/serverFns/sso.ts

@@ -1,10 +1,24 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
+import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { getProService } from '@/server/pro-services'
 import { checkRateLimit } from '@/lib/pacer'
 
 const SSO_DOMAIN_RATE_LIMIT = { max: 20, windowMs: 60_000 }
+// 审计 ⚪（2026-10-25）：仅按 domain 限流时，攻击者可轮换不同 domain 无限探测
+// SSO provider 存在性；叠加 IP 维度桶（Vercel 边缘恒注入 x-forwarded-for，
+// 缺失时收敛到共享桶兜底）
+const SSO_IP_RATE_LIMIT = { max: 60, windowMs: 60_000 }
+
+function clientIp(request: Request): string {
+  const fwd = request.headers.get('x-forwarded-for')
+  if (fwd) {
+    const first = fwd.split(',')[0]?.trim()
+    if (first) return first
+  }
+  return request.headers.get('x-real-ip')?.trim() || 'unknown'
+}
 
 export const checkSsoDomainFn = createServerFn({ method: 'GET' })
   .validator(z.object({ email: z.string().min(3).max(254) }))
@@ -18,6 +32,8 @@ export const checkSsoDomainFn = createServerFn({ method: 'GET' })
 
     const rl = checkRateLimit(`sso-domain:${domain}`, SSO_DOMAIN_RATE_LIMIT)
     if (!rl.allowed) return null
+    const ipRl = checkRateLimit(`sso-ip:${clientIp(getRequest())}`, SSO_IP_RATE_LIMIT)
+    if (!ipRl.allowed) return null
 
     const provider = await prisma.ssoProvider.findFirst({
       where: { domain, enabled: true },

package/src/server/serverFns/story/__tests__/story-assoc.test.ts

@@ -51,8 +51,10 @@ const mocks = vi.hoisted(() => ({
   docFindMany: vi.fn(),
   linkFindMany: vi.fn(),
   linkCreateMany: vi.fn(),
+  linkDeleteMany: vi.fn(),
   designLinkFindMany: vi.fn(),
   designLinkCreateMany: vi.fn(),
+  designLinkDeleteMany: vi.fn(),
   extLinkFindMany: vi.fn(),
   extLinkCreateMany: vi.fn(),
   extLinkDeleteMany: vi.fn(),
@@ -67,8 +69,16 @@ vi.mock("@allbluecn/database", () => {
     story: { findUnique: mocks.storyFindUnique },
     knowledgeBase: { findMany: mocks.kbFindMany, findFirst: mocks.kbFindFirst },
     knowledgeDocument: { findMany: mocks.docFindMany },
-    storyDocLink: { findMany: mocks.linkFindMany, createMany: mocks.linkCreateMany },
-    storyDesignLink: { findMany: mocks.designLinkFindMany, createMany: mocks.designLinkCreateMany },
+    storyDocLink: {
+      findMany: mocks.linkFindMany,
+      createMany: mocks.linkCreateMany,
+      deleteMany: mocks.linkDeleteMany,
+    },
+    storyDesignLink: {
+      findMany: mocks.designLinkFindMany,
+      createMany: mocks.designLinkCreateMany,
+      deleteMany: mocks.designLinkDeleteMany,
+    },
     storyExternalLink: {
       findMany: mocks.extLinkFindMany,
       createMany: mocks.extLinkCreateMany,
@@ -77,6 +87,8 @@ vi.mock("@allbluecn/database", () => {
     storyActivity: { create: mocks.activityCreate },
     projectMember: { findUnique: mocks.memberFindUnique },
     design: { findMany: mocks.designFindMany },
+    // unlink 幂等化/建链事务化后需要 $transaction（tx=同一 mock 实例直调）
+    $transaction: (cb: (tx: any) => Promise<unknown>) => cb(prisma),
   };
   return { prisma, Prisma: {} };
 });
@@ -113,6 +125,9 @@ beforeEach(() => {
   mocks.extLinkFindMany.mockResolvedValue([]);
   mocks.extLinkCreateMany.mockResolvedValue({ count: 0 });
   mocks.extLinkDeleteMany.mockResolvedValue({ count: 0 });
+  // unlink 幂等化：默认链接行存在（count>0 才写活动）
+  mocks.linkDeleteMany.mockResolvedValue({ count: 1 });
+  mocks.designLinkDeleteMany.mockResolvedValue({ count: 1 });
   mocks.activityCreate.mockResolvedValue({
     id: "act1",
     action: "kb_linked",

package/src/server/serverFns/story/__tests__/story-dependencies.test.ts

@@ -136,6 +136,8 @@ beforeEach(() => {
   ]);
   // 默认 u1 是 p1 的有效成员（SEC-03 口径：suspended 视同无权）
   mocks.memberFindUnique.mockResolvedValue({ status: "active" });
+  // 读侧成员校验反查需求所属项目（审计 2026-10-25：getDependenciesFn 补 assertStoryProjectMember）
+  mocks.storyFindUnique.mockResolvedValue({ projectId: "p1" });
   mocks.activityCreate.mockImplementation(({ data }: any) =>
     Promise.resolve({
       id: `act-${data.storyId}`,
@@ -384,6 +386,12 @@ describe("removeDependencyFn", () => {
 });
 
 describe("getDependenciesFn", () => {
+  it("非项目成员 → 无权限，不读依赖边", async () => {
+    mocks.memberFindUnique.mockResolvedValue(null);
+    await expect(getDependenciesFn({ data: { storyId: "me" } })).rejects.toThrow("无权限操作该项目的需求");
+    expect(mocks.depFindMany).not.toHaveBeenCalled();
+  });
+
   it("双视角分组：dependsOn 取 source，dependents 取 target", async () => {
     mocks.depFindMany.mockResolvedValue([
       { id: "d1", sourceId: "s1", targetId: "me", type: "BLOCKS" },

package/src/server/serverFns/story/__tests__/story-read-path-authz.test.ts

@@ -0,0 +1,141 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 审计 2026-10-25 主题 1「读路径鉴权缺口」story 域回归哨兵：十余个 GET serverFn 此前仅
+// requireAuth（同文件写路径均有成员校验）。本文件钉死：非项目有效成员调用任一读接口
+// → 抛「无权限操作该项目的需求」且不触碰业务表；成员则放行。
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: (_config: unknown) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema;
+        return this;
+      },
+      handler(fn: Function) {
+        return async (args: any) => {
+          let data = args?.data;
+          if (this._validator && data !== undefined && this._validator.parse) data = this._validator.parse(data);
+          return fn({ data });
+        };
+      },
+    };
+    return api;
+  },
+}));
+vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => undefined }));
+vi.mock("@/server/auth-helpers", () => ({ requireAuth: vi.fn(async () => ({ user: { id: "u1" } })) }));
+vi.mock("@/server/collab/write-guard", () => ({ withCollabGuard: vi.fn() }));
+// 本文件只断言鉴权，不关心行形状：castStoryUsers 透传，免得为 detail 伪造完整 Story 行
+vi.mock("@/server/story/types", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/server/story/types")>()),
+  castStoryUsers: (s: unknown) => s,
+}));
+vi.mock("@/server/builtin-project", () => ({
+  resolveStoryScopeProjectIds: vi.fn(async () => ["p1"]),
+  resolveStoryScopeProjectId: vi.fn(async () => "p1"),
+}));
+
+const M = vi.hoisted(() => {
+  const f = () => vi.fn();
+  return {
+    story: { findUnique: f(), findMany: f(), count: f() },
+    projectMember: { findUnique: f(), findMany: f() },
+    storyAttachment: { findMany: f() },
+    storyComment: { findMany: f() },
+    storyActivity: { findMany: f() },
+    storyDependency: { findMany: f() },
+    storyLink: { findMany: f() },
+    storyDesignLink: { findMany: f() },
+    storyReaction: { findMany: f() },
+  };
+});
+vi.mock("@allbluecn/database", () => ({ prisma: M }));
+
+import { getStoryDetailFn, getStoryNeighborsFn } from "../story-crud/detail";
+import { listActivitiesFn } from "../story-crud/activities";
+import { getAttachmentsFn } from "../story-attachments";
+import { listChildStoriesFn } from "../story-children";
+import { listCommentsFn } from "../story-comments";
+import { getDependenciesFn } from "../story-dependencies";
+import { getLinksFn } from "../story-links";
+import { getLinkedDesignsFn } from "../story-assoc";
+import { listStoryReactionsFn } from "../story-reactions";
+
+type Fn = (a: { data: unknown }) => Promise<unknown>;
+const FORBIDDEN = "无权限操作该项目的需求";
+
+const readers: Array<{ name: string; fn: Fn; data: unknown; table: { findMany: ReturnType<typeof vi.fn> } }> = [
+  { name: "getStoryDetailFn", fn: getStoryDetailFn as unknown as Fn, data: { storyId: "s1" }, table: M.story },
+  { name: "listActivitiesFn", fn: listActivitiesFn as unknown as Fn, data: { storyId: "s1" }, table: M.storyActivity },
+  { name: "getAttachmentsFn", fn: getAttachmentsFn as unknown as Fn, data: { storyId: "s1" }, table: M.storyAttachment },
+  { name: "listChildStoriesFn", fn: listChildStoriesFn as unknown as Fn, data: { parentId: "s1" }, table: M.story },
+  { name: "listCommentsFn", fn: listCommentsFn as unknown as Fn, data: { storyId: "s1" }, table: M.storyComment },
+  { name: "getDependenciesFn", fn: getDependenciesFn as unknown as Fn, data: { storyId: "s1" }, table: M.storyDependency },
+  { name: "getLinksFn", fn: getLinksFn as unknown as Fn, data: { storyId: "s1" }, table: M.storyLink },
+  { name: "getLinkedDesignsFn", fn: getLinkedDesignsFn as unknown as Fn, data: { storyId: "s1" }, table: M.storyDesignLink },
+  { name: "listStoryReactionsFn", fn: listStoryReactionsFn as unknown as Fn, data: { storyId: "s1" }, table: M.storyReaction },
+];
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  M.story.findUnique.mockResolvedValue({ id: "s1", projectId: "p1", createdAt: new Date(), updatedAt: new Date(), sequenceId: 1 });
+  M.story.findMany.mockResolvedValue([]);
+  for (const t of [M.storyAttachment, M.storyComment, M.storyActivity, M.storyDependency, M.storyLink, M.storyDesignLink, M.storyReaction]) {
+    t.findMany.mockResolvedValue([]);
+  }
+  M.projectMember.findMany.mockResolvedValue([]);
+});
+
+describe("story 域读路径：非成员一律拒绝且不读业务表", () => {
+  it.each(readers.map((r) => [r.name, r] as const))("%s", async (_name, r) => {
+    M.projectMember.findUnique.mockResolvedValue(null);
+    await expect(r.fn({ data: r.data })).rejects.toThrow(FORBIDDEN);
+    expect(r.table.findMany).not.toHaveBeenCalled();
+    expect(M.projectMember.findUnique).toHaveBeenCalledWith({
+      where: { projectId_userId: { projectId: "p1", userId: "u1" } },
+      select: { status: true },
+    });
+  });
+
+  it("suspended 成员同样拒绝", async () => {
+    M.projectMember.findUnique.mockResolvedValue({ status: "suspended" });
+    await expect((listCommentsFn as unknown as Fn)({ data: { storyId: "s1" } })).rejects.toThrow(FORBIDDEN);
+  });
+});
+
+describe("story 域读路径：有效成员放行", () => {
+  it.each(readers.map((r) => [r.name, r] as const))("%s", async (_name, r) => {
+    M.projectMember.findUnique.mockResolvedValue({ status: "active" });
+    await expect(r.fn({ data: r.data })).resolves.toBeDefined();
+  });
+
+  it("getStoryNeighborsFn：需求不存在返回双 null（不泄露存在性，不做成员查询）；存在则先校验成员", async () => {
+    M.story.findUnique.mockResolvedValue(null);
+    await expect((getStoryNeighborsFn as unknown as Fn)({ data: { storyId: "missing" } })).resolves.toEqual({
+      prevId: null,
+      nextId: null,
+    });
+    expect(M.projectMember.findUnique).not.toHaveBeenCalled();
+
+    M.story.findUnique.mockResolvedValue({ id: "s1", projectId: "p1", createdAt: new Date() });
+    M.projectMember.findUnique.mockResolvedValue(null);
+    await expect((getStoryNeighborsFn as unknown as Fn)({ data: { storyId: "s1" } })).rejects.toThrow(FORBIDDEN);
+  });
+});

package/src/server/serverFns/story/index.ts

@@ -15,8 +15,8 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+export { listUsersBriefFn } from "./story-crud/user-brief";
 export {
-  listUsersBriefFn,
   listLabelsFn,
   createLabelFn,
 } from "./story-crud/labels";
@@ -71,10 +71,8 @@ export {
 } from "./story-reactions";
 
 export {
-  getStoryTreeFn,
   addChildFn,
   removeChildFn,
-  getChildrenCountFn,
 } from "./story-tree";
 
 export {

package/src/server/serverFns/story/kb-scope.ts

@@ -15,6 +15,10 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+// 纯常量+纯函数模块（无 createServerFn、零服务端依赖，客户端可安全导入——
+// 审计 serverFn 纯净性口径的 GRANDFATHERED 留守文件，勿在此新增服务端 import）。
+// 消费方：serverFns/story/story-assoc.ts（服务端 KB 查询 where 构造）。
+
 import type { Prisma } from "@allbluecn/database";
 import { BUILTIN_INDEPENDENT_DISPLAY_ID } from "@/lib/builtin-project";
 
@@ -33,6 +37,11 @@ export function isIndependentProject(displayId: string | null): boolean {
  * 需求可选知识库范围（Prisma where，用于 KnowledgeBase 查询）：
  * - 普通项目：visibility=general（跨用户）∪ 项目关联 KB（关联仅允许 team）
  * - 独立需求（STORY）：自己的全部 ∪ 他人 team/general
+ *
+ * ⚠ 可见性语义注记（审计 ⚪ 2026-10-25，留待产品确认）：独立需求分支放行他人
+ * `team` 可见性 KB——前提是本产品 `team` 取「平台内全员可发现」语义（与项目
+ * KB 关联仅允许 team 的口径一致）；若 `team` 改为「所有者团队内可见」，此处
+ * 须同步收紧为按团队过滤。
  */
 export function buildKbScopeWhere(input: KbScopeInput): Prisma.KnowledgeBaseWhereInput {
   if (isIndependentProject(input.projectDisplayId)) {

package/src/server/serverFns/story/link-preview.ts

@@ -21,9 +21,10 @@ import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { checkUserActionRateLimit } from "@/server/lib/rate-limit";
 import { assertFetchableUrl } from "@/server/fetch-guard";
+import { httpUrl } from "@/server/lib/validators";
 
 const checkSchema = z.object({
-  url: z.string().url(),
+  url: httpUrl,
   origin: z.string().url().optional(),
 });
 

package/src/server/serverFns/story/story-assoc.ts

@@ -34,29 +34,7 @@ import {
 
 // ---------- 通用知识库（法律法规/行业合规/词典词条/网站收藏/周报月报） ----------
 
-/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的需求");
-  }
-}
 
-/** 反查需求所属项目并校验成员资格（同 bug 域 assertBugProjectMember 范式） */
-async function assertStoryProjectMember(storyId: string, userId: string): Promise<string> {
-  const prisma = await getPrisma();
-  const story = await prisma.story.findUnique({
-    where: { id: storyId },
-    select: { projectId: true },
-  });
-  if (!story) throw new Error("需求不存在");
-  await assertProjectMembership(story.projectId, userId);
-  return story.projectId;
-}
 
 export type { SearchDocRow } from "@/server/knowledge/kb-doc-search";
 import {
@@ -65,6 +43,7 @@ import {
   toSearchDocRow as toDocBrief,
   type SearchDocRow as SearchDocRow_,
 } from "@/server/knowledge/kb-doc-search";
+import { assertStoryProjectMember } from "@/server/story/permissions";
 
 // 批量关联设计（PRD 文档与 UI 画板同源 Design 表，链接统一落 storyDesignLink）。
 // 设计单属主：仅本人未删除设计可关联（口径同 searchDesignsFn），越界 id 归 failed。
@@ -74,7 +53,7 @@ export const linkDesignsFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 
@@ -125,7 +104,7 @@ export const unlinkDesignFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 
@@ -158,6 +137,7 @@ export const getLinkedDesignsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
+    await assertStoryProjectMember(data.storyId, session.user.id);
 
     const links = await prisma.storyDesignLink.findMany({
       where: { storyId: data.storyId, design: { isDeleted: false } },
@@ -185,7 +165,7 @@ export const searchDesignsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // Design 单属主（无项目归属），口径同 listDesignsFn / attach-guards：仅返回本人未删除设计
     const prds = await prisma.design.findMany({
@@ -229,7 +209,7 @@ export const listStoryAvailableKbsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const scope = await resolveStoryScope(data.storyId, session.user!.id!);
+    const scope = await resolveStoryScope(data.storyId, session.user.id);
     const kbs = await prisma.knowledgeBase.findMany({
       where: { AND: [scope, { isDeleted: false }] },
       select: { id: true, name: true, icon: true, visibility: true },
@@ -252,11 +232,11 @@ export const searchKbDocsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const scope = await resolveStoryScope(data.storyId, session.user!.id!);
+    const scope = await resolveStoryScope(data.storyId, session.user.id);
 
     if (data.generalGroup) {
       // 态③：通用知识库分组 → 平铺列表（周报月报暂无实体内容）
-      const items = await searchGeneralGroupDocs(data.generalGroup, session.user!.id!, data.query);
+      const items = await searchGeneralGroupDocs(data.generalGroup, session.user.id, data.query);
       return { items, nextCursor: null };
     }
 
@@ -306,7 +286,7 @@ export const linkDocsFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await assertStoryProjectMember(data.storyId, userId);
     const scope = await resolveStoryScope(data.storyId, userId);
 
@@ -420,7 +400,7 @@ export const unlinkDocFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 

package/src/server/serverFns/story/story-attachments.ts

@@ -21,18 +21,10 @@ import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { ACTIVITY_SELECT, toActivityItem } from "@/server/story/types";
-
-/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的需求");
-  }
-}
+import {
+  assertStoryProjectMember,
+  assertStoryProjectMembership as assertProjectMembership,
+} from "@/server/story/permissions";
 
 export const removeAttachmentFn = createServerFn({ method: "POST" })
   .validator(z.object({ attachmentId: z.string() }))
@@ -40,7 +32,7 @@ export const removeAttachmentFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const attachment = await prisma.storyAttachment.findUnique({ where: { id: data.attachmentId } });
     // 反查附件所属需求的项目成员资格（SEC-03：防删他人需求的附件）
@@ -80,6 +72,7 @@ export const getAttachmentsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
+    await assertStoryProjectMember(data.storyId, session.user.id);
 
     const attachments = await prisma.storyAttachment.findMany({
       where: { storyId: data.storyId },

package/src/server/serverFns/story/story-children.ts

@@ -20,6 +20,7 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
+import { assertStoryProjectMember } from "@/server/story/permissions";
 import { STORY_LIST_SELECT, castStoryUsers } from "@/server/story/types";
 
 import type { StoryListItem } from "@/components/story/types";
@@ -31,7 +32,9 @@ export const listChildStoriesFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    // 经父需求反查项目做成员校验
+    await assertStoryProjectMember(data.parentId, session.user.id);
 
     const stories = await prisma.story.findMany({
       where: { parentId: data.parentId, archived: false },

package/src/server/serverFns/story/story-comments.ts

@@ -22,30 +22,9 @@ import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import type { CommentWithReplies, ReactionGroup } from "@/components/story/types";
 import { USER_BRIEF_SELECT, castUserBrief, aggregateReactions } from "@/server/story/types";
+import { assertStoryProjectMember, assertStoryProjectMembership as assertProjectMembership } from "@/server/story/permissions";
+
 
-/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的需求");
-  }
-}
-
-/** 反查需求所属项目并校验成员资格（同 bug 域 assertBugProjectMember 范式） */
-async function assertStoryProjectMember(storyId: string, userId: string): Promise<string> {
-  const prisma = await getPrisma();
-  const story = await prisma.story.findUnique({
-    where: { id: storyId },
-    select: { projectId: true },
-  });
-  if (!story) throw new Error("需求不存在");
-  await assertProjectMembership(story.projectId, userId);
-  return story.projectId;
-}
 
 export const listCommentsFn = createServerFn({ method: "GET" })
   .validator(z.object({ storyId: z.string() }))
@@ -53,7 +32,8 @@ export const listCommentsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
+    await assertStoryProjectMember(data.storyId, userId);
 
     const comments = await prisma.storyComment.findMany({
       where: { storyId: data.storyId },
@@ -108,7 +88,7 @@ export const createCommentFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 
@@ -159,7 +139,7 @@ export const updateCommentFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const existing = await prisma.storyComment.findUnique({
       where: { id: data.commentId },
@@ -188,7 +168,7 @@ export const deleteCommentFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const existing = await prisma.storyComment.findUnique({
       where: { id: data.commentId },

package/src/server/serverFns/story/story-crud/activities.ts

@@ -20,6 +20,7 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
+import { assertStoryProjectMember } from "@/server/story/permissions";
 import { USER_BRIEF_SELECT, castUserBrief } from "@/server/story/types";
 
 const listActivitiesSchema = z.object({
@@ -33,7 +34,8 @@ export const listActivitiesFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    await assertStoryProjectMember(data.storyId, session.user.id);
 
     const activities = await prisma.storyActivity.findMany({
       where: {