@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/story/story-crud/archive.ts

@@ -23,32 +23,11 @@ import { requireAuth } from "@/server/auth-helpers";
 import { STORY_LIST_SELECT, castStoryUsers } from "@/server/story/types";
 import { buildRoomName } from "@allbluecn/collab-core/rooms";
 import { touchCollabSnapshot } from "@/server/collab/touch-snapshot";
+import { assertStoryProjectMember } from "@/server/story/permissions";
 
 const archiveStorySchema = z.object({ storyId: z.string() });
 
-/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的需求");
-  }
-}
-
-/** 反查需求所属项目并校验成员资格（同 bug 域 assertBugProjectMember 范式） */
-async function assertStoryProjectMember(storyId: string, userId: string): Promise<string> {
-  const prisma = await getPrisma();
-  const story = await prisma.story.findUnique({
-    where: { id: storyId },
-    select: { projectId: true },
-  });
-  if (!story) throw new Error("需求不存在");
-  await assertProjectMembership(story.projectId, userId);
-  return story.projectId;
-}
+
 
 export const archiveStoryFn = createServerFn({ method: "POST" })
   .validator(archiveStorySchema)
@@ -56,7 +35,7 @@ export const archiveStoryFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 
@@ -98,7 +77,7 @@ export const unarchiveStoryFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 

package/src/server/serverFns/story/story-crud/bulk.ts

@@ -44,7 +44,7 @@ export const bulkArchiveStoriesFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     const visibleProjectIds = await accessibleProjectIds(userId);
 
     return prisma.$transaction(async (tx) => {
@@ -88,7 +88,7 @@ export const bulkDeleteStoriesFn = createServerFn({ method: "POST" })
     const request = getRequest();
     const session = await requireAuth(request);
     // 可见性过滤进 where：跨项目 id 静默跳过而非报错（SEC-03/DB-03：单语句消除跨项目删除）
-    const visibleProjectIds = await accessibleProjectIds(session.user!.id!);
+    const visibleProjectIds = await accessibleProjectIds(session.user.id);
     const result = await prisma.story.deleteMany({
       where: { id: { in: data.storyIds }, projectId: { in: visibleProjectIds } },
     });
@@ -117,7 +117,7 @@ export const bulkUpdateStoriesFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     const visibleProjectIds = await accessibleProjectIds(userId);
 
     return prisma.$transaction(async (tx) => {

package/src/server/serverFns/story/story-crud/detail.ts

@@ -20,6 +20,7 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
+import { assertStoryProjectMember, assertStoryProjectMembership } from "@/server/story/permissions";
 import { STORY_LIST_SELECT, castStoryUsers } from "@/server/story/types";
 
 const detailSchema = z.object({ storyId: z.string() });
@@ -29,13 +30,15 @@ export const getStoryNeighborsFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
 
     const current = await prisma.story.findUnique({
       where: { id: data.storyId },
       select: { id: true, projectId: true, createdAt: true },
     });
     if (!current) return { prevId: null, nextId: null };
+    // 读侧成员校验（复用已查到的 projectId，免二次反查）
+    await assertStoryProjectMembership(current.projectId, session.user.id);
 
     const [prev, next] = await Promise.all([
       prisma.story.findFirst({
@@ -58,7 +61,9 @@ export const getStoryDetailFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    // 读侧与写侧同口径：须为需求所属项目的有效成员（审计 2026-10-25 story 域读路径缺口）
+    await assertStoryProjectMember(data.storyId, session.user.id);
     const story = await prisma.story.findUnique({
       where: { id: data.storyId },
       select: { ...STORY_LIST_SELECT, sequenceId: true },

package/src/server/serverFns/story/story-crud/labels.ts

@@ -20,7 +20,6 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
-import { USER_BRIEF_SELECT } from "@/server/story/types";
 import { upsertLabel } from "@/server/story/story-crud/label-upsert";
 
 const labelCreateSchema = z.object({
@@ -28,62 +27,6 @@ const labelCreateSchema = z.object({
   color: z.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
 });
 
-export const listUsersBriefFn = createServerFn({ method: "GET" })
-  .validator((data?: { projectId?: string }) => data)
-  .handler(async ({ data }) => {
-    const prisma = await getPrisma()
-    const request = getRequest();
-    const session = await requireAuth(request);
-    const currentUserId = session.user!.id!;
-
-    if (data?.projectId) {
-      // 项目级别：只返回项目成员
-      const project = await prisma.project.findUnique({
-        where: { id: data.projectId },
-        select: { ownerId: true, workspaceId: true },
-      });
-      if (!project) return [];
-
-      const members = await prisma.projectMember.findMany({
-        where: { projectId: data.projectId },
-        select: { userId: true },
-      });
-      const memberIds = new Set(members.map((m) => m.userId));
-      memberIds.add(project.ownerId);
-
-      const users = await prisma.user.findMany({
-        where: { id: { in: Array.from(memberIds) }, status: "ACTIVE" },
-        orderBy: { username: "asc" },
-        select: USER_BRIEF_SELECT,
-      });
-      return users.map((u) => ({
-        ...u,
-        avatarConfig: (u.avatarConfig as import("@allbluecn/kernel").AvatarConfig | null) ?? null,
-      }));
-    }
-
-    // 团队级别：只返回当前用户团队（team_memberships.ownerId = 当前用户）的成员
-    const memberships = await prisma.teamMembership.findMany({
-      where: { ownerId: currentUserId },
-      select: { memberId: true },
-    });
-    if (memberships.length === 0) {
-      return [];
-    }
-    const memberIds = new Set(memberships.map((m) => m.memberId));
-    memberIds.add(currentUserId); // 包含自己
-
-    const users = await prisma.user.findMany({
-      where: { id: { in: Array.from(memberIds) }, status: "ACTIVE" },
-      orderBy: { username: "asc" },
-      select: USER_BRIEF_SELECT,
-    });
-    return users.map((u) => ({
-      ...u,
-      avatarConfig: (u.avatarConfig as import("@allbluecn/kernel").AvatarConfig | null) ?? null,
-    }));
-  });
-
 export const listLabelsFn = createServerFn({ method: "GET" }).handler(
   async () => {
     const prisma = await getPrisma()
@@ -102,5 +45,5 @@ export const createLabelFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    return upsertLabel(data.name, session.user!.id!, data.color);
+    return upsertLabel(data.name, session.user.id, data.color);
   });

package/src/server/serverFns/story/story-crud/user-brief.ts

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+
+// 用户 brief 列表（团队/项目两级成员）——原居 story-crud/labels.ts（审计 A6x-2：
+// 与标签 CRUD 无关的职责混装），迁出为单一职责文件，客户端消费方同步改 import。
+import { getPrisma } from "@allbluecn/database/get-prisma"
+import { createServerFn } from "@tanstack/react-start";
+import { getRequest } from "@tanstack/react-start/server";
+import { requireAuth } from "@/server/auth-helpers";
+import { assertStoryProjectMembership } from "@/server/story/permissions";
+import { USER_BRIEF_SELECT } from "@/server/story/types";
+
+export const listUsersBriefFn = createServerFn({ method: "GET" })
+  .validator((data?: { projectId?: string }) => data)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    const request = getRequest();
+    const session = await requireAuth(request);
+    const currentUserId = session.user.id;
+
+    if (data?.projectId) {
+      // 项目级别：只返回项目成员——且仅对该项目的有效成员开放（防跨项目成员枚举）
+      await assertStoryProjectMembership(data.projectId, currentUserId);
+      const project = await prisma.project.findUnique({
+        where: { id: data.projectId },
+        select: { ownerId: true, workspaceId: true },
+      });
+      if (!project) return [];
+
+      const members = await prisma.projectMember.findMany({
+        where: { projectId: data.projectId },
+        select: { userId: true },
+      });
+      const memberIds = new Set(members.map((m) => m.userId));
+      memberIds.add(project.ownerId);
+
+      const users = await prisma.user.findMany({
+        where: { id: { in: Array.from(memberIds) }, status: "ACTIVE" },
+        orderBy: { username: "asc" },
+        select: USER_BRIEF_SELECT,
+      });
+      return users.map((u) => ({
+        ...u,
+        avatarConfig: (u.avatarConfig as import("@allbluecn/kernel").AvatarConfig | null) ?? null,
+      }));
+    }
+
+    // 团队级别：只返回当前用户团队（team_memberships.ownerId = 当前用户）的成员
+    const memberships = await prisma.teamMembership.findMany({
+      where: { ownerId: currentUserId },
+      select: { memberId: true },
+    });
+    if (memberships.length === 0) {
+      return [];
+    }
+    const memberIds = new Set(memberships.map((m) => m.memberId));
+    memberIds.add(currentUserId); // 包含自己
+
+    const users = await prisma.user.findMany({
+      where: { id: { in: Array.from(memberIds) }, status: "ACTIVE" },
+      orderBy: { username: "asc" },
+      select: USER_BRIEF_SELECT,
+    });
+    return users.map((u) => ({
+      ...u,
+      avatarConfig: (u.avatarConfig as import("@allbluecn/kernel").AvatarConfig | null) ?? null,
+    }));
+  });

package/src/server/serverFns/story/story-crud.ts

@@ -22,7 +22,7 @@ import { z } from "zod";
 import { buildRoomName } from "@allbluecn/collab-core/rooms";
 import { requireAuth } from "@/server/auth-helpers";
 import { ensureBuiltinIndependentProject, resolveStoryScopeProjectIds } from "@/server/builtin-project";
-import { isUserInTeam } from "@/server/team-access";
+import { validateAssignee } from "@/server/lib/validate-assignee";
 import { withCollabGuard } from "@/server/collab/write-guard";
 import { touchCollabSnapshot } from "@/server/collab/touch-snapshot";
 import type { ActivityItem } from "@/components/story/types";
@@ -33,30 +33,12 @@ import { buildListWhere } from "./story-list-query";
 import { createStoryInternal } from "./story-crud/create-story-internal";
 import { withSequenceNumberRetry } from "@/server/lib/sequence-number-retry";
 import type { Prisma } from "@allbluecn/database";
+import { assertProjectMembership as assertProjectMembershipShared } from "@/server/lib/project-membership";
 
-/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的需求");
-  }
-}
+/** 项目有效成员校验（共享口径见 server/lib/project-membership：suspended 视同无权限） */
+const assertProjectMembership = (projectId: string, userId: string) =>
+  assertProjectMembershipShared(projectId, userId, "无权限操作该项目的需求");
 
-async function validateAssignee(projectId: string, assigneeId: string | null | undefined) {
-  if (!assigneeId) return;
-  const prisma = await getPrisma();
-  const project = await prisma.project.findUnique({
-    where: { id: projectId },
-    select: { ownerId: true },
-  });
-  if (!project) throw new Error("项目不存在");
-  const ok = await isUserInTeam(project.ownerId, assigneeId);
-  if (!ok) throw new Error("负责人必须是团队成员");
-}
 
 const listSchema = z.object({
   state: z.string().optional(),
@@ -77,7 +59,7 @@ export const listStoriesFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const projectIds = await resolveStoryScopeProjectIds(data.projectId, userId);
 
@@ -121,7 +103,7 @@ export const createStoryFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     let projectId = data.projectId;
     if (!projectId) {
@@ -222,7 +204,7 @@ export const updateStoryFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // ── Yjs 多人协作 §5.3 写入门卫（任务 21；审查修正：提至 $transaction
     // 之前——门卫转发含网络 I/O（TTL 内重试最坏 ≈4s），事务内等待会击穿
@@ -536,7 +518,7 @@ export const deleteStoryFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // 先取回目标行校验成员资格，再删（SEC-03：防跨项目删除他人需求）
     const existing = await prisma.story.findUnique({

package/src/server/serverFns/story/story-dependencies.ts

@@ -23,33 +23,11 @@ import { requireAuth } from "@/server/auth-helpers";
 import { resolveStoryScopeProjectIds } from "@/server/builtin-project";
 import { STORY_LIST_SELECT, castStoryUsers, ACTIVITY_SELECT, toActivityItem } from "@/server/story/types";
 import type { DependencyRow } from "@/components/story/types";
+import { assertStoryProjectMember, assertStoriesProjectMember } from "@/server/story/permissions";
 
 const edgeTypeSchema = z.enum(["BLOCKS", "STARTS_BEFORE", "FINISHES_BEFORE"]);
 
-/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的需求");
-  }
-}
 
-/** 批量校验一组需求的所属项目成员资格（依赖边可能跨项目，两端都须为有效成员） */
-async function assertStoriesProjectMember(storyIds: string[], userId: string) {
-  const prisma = await getPrisma();
-  const rows = await prisma.story.findMany({
-    where: { id: { in: storyIds } },
-    select: { projectId: true },
-  });
-  const projectIds = [...new Set(rows.map((r) => r.projectId))];
-  for (const projectId of projectIds) {
-    await assertProjectMembership(projectId, userId);
-  }
-}
 
 /** 依赖边无向归一化键（查重口径：双向均视为同一条边） */
 function normalizedEdgeKey(a: string, b: string): string {
@@ -74,7 +52,7 @@ export const addDependenciesFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // 本批全部端点需求的项目成员资格（SEC-03：防跨项目建依赖边）
     await assertStoriesProjectMember(
@@ -217,7 +195,7 @@ export const updateDependencyFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const dep = await prisma.storyDependency.findUnique({ where: { id: data.depId } });
     if (!dep) throw new Error("依赖关系不存在");
@@ -308,7 +286,7 @@ export const removeDependencyFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const dep = await prisma.storyDependency.findUnique({ where: { id: data.depId } });
     if (!dep) return null;
@@ -343,7 +321,8 @@ export const getDependenciesFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    await assertStoryProjectMember(data.storyId, session.user.id);
 
     const deps = await prisma.storyDependency.findMany({
       where: { OR: [{ targetId: data.storyId }, { sourceId: data.storyId }] },
@@ -385,7 +364,7 @@ export const listStoryDependenciesFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // 「全部项目」聚合语义：缺省 → 成员关系内全部 projectId；显式 → 单元素数组（含鉴权）
     const projectIds = await resolveStoryScopeProjectIds(data.projectId, userId);

package/src/server/serverFns/story/story-groups.ts

@@ -21,8 +21,8 @@ import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { resolveStoryScopeProjectIds } from "@/server/builtin-project";
-import { GROUP_KEYS, ORDER_KEYS, ORDER_DIRECTIONS, resolveOrderDir } from "@/components/shared-kit/list-kit/display/values";
-import type { GroupKey, OrderKey } from "@/components/shared-kit/list-kit/display/types";
+import { GROUP_KEYS, ORDER_KEYS, ORDER_DIRECTIONS, resolveOrderDir } from "@/shared/list-kit/display-values";
+import type { GroupKey, OrderKey } from "@/shared/list-kit/display-types";
 import { STORY_STATES, STORY_PRIORITIES, type StoryState, type StoryPriority } from "@/components/story/constants";
 import { STORY_LIST_SELECT_LIGHT, castStoryUsersLight, type StoryListRowLight } from "@/server/story/types";
 import { buildListWhere, buildGroupFilter } from "./story-list-query";
@@ -62,7 +62,7 @@ export const listStoriesInGroupFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const projectIds = await resolveStoryScopeProjectIds(data.projectId, userId);
 
@@ -125,7 +125,7 @@ export const listAllGroupsItemsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const projectIds = await resolveStoryScopeProjectIds(data.projectId, userId);
 
@@ -240,7 +240,7 @@ export const listStoryGroupsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const projectIds = await resolveStoryScopeProjectIds(data.projectId, userId);
 

package/src/server/serverFns/story/story-links.ts

@@ -21,38 +21,18 @@ import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { ACTIVITY_SELECT, toActivityItem } from "@/server/story/types";
+import { assertStoryProjectMember, assertStoryProjectMembership as assertProjectMembership } from "@/server/story/permissions";
+import { httpUrl } from "@/server/lib/validators";
+
 
-/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的需求");
-  }
-}
-
-/** 反查需求所属项目并校验成员资格（同 bug 域 assertBugProjectMember 范式） */
-async function assertStoryProjectMember(storyId: string, userId: string): Promise<string> {
-  const prisma = await getPrisma();
-  const story = await prisma.story.findUnique({
-    where: { id: storyId },
-    select: { projectId: true },
-  });
-  if (!story) throw new Error("需求不存在");
-  await assertProjectMembership(story.projectId, userId);
-  return story.projectId;
-}
 
 export const addLinkFn = createServerFn({ method: "POST" })
-  .validator(z.object({ storyId: z.string(), url: z.string().url(), title: z.string().optional(), description: z.string().optional() }))
+  .validator(z.object({ storyId: z.string(), url: httpUrl, title: z.string().optional(), description: z.string().optional() }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 
@@ -79,12 +59,12 @@ export const addLinkFn = createServerFn({ method: "POST" })
   });
 
 export const updateLinkFn = createServerFn({ method: "POST" })
-  .validator(z.object({ linkId: z.string(), url: z.string().url().optional(), title: z.string().optional(), description: z.string().optional() }))
+  .validator(z.object({ linkId: z.string(), url: httpUrl.optional(), title: z.string().optional(), description: z.string().optional() }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // 反查链接所属需求的项目成员资格（SEC-03：防改他人需求的链接）
     const existing = await prisma.storyLink.findUnique({
@@ -122,7 +102,7 @@ export const removeLinkFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const link = await prisma.storyLink.findUnique({
       where: { id: data.linkId },
@@ -156,6 +136,7 @@ export const getLinksFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
+    await assertStoryProjectMember(data.storyId, session.user.id);
 
     const links = await prisma.storyLink.findMany({
       where: { storyId: data.storyId },

package/src/server/serverFns/story/story-list-query.ts

@@ -16,7 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { Prisma } from "@allbluecn/database";
-import type { GroupKey } from "@/components/shared-kit/list-kit/display/types";
+import type { GroupKey } from "@/shared/list-kit/display-types";
 import { toValidDate } from "@/server/story/types";
 
 export function buildListWhere(data: {

package/src/server/serverFns/story/story-reactions.ts

@@ -21,30 +21,9 @@ import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { aggregateReactions } from "@/server/story/types";
+import { assertStoryProjectMember, assertStoryProjectMembership as assertProjectMembership } from "@/server/story/permissions";
+
 
-/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的需求");
-  }
-}
-
-/** 反查需求所属项目并校验成员资格（同 bug 域 assertBugProjectMember 范式） */
-async function assertStoryProjectMember(storyId: string, userId: string): Promise<string> {
-  const prisma = await getPrisma();
-  const story = await prisma.story.findUnique({
-    where: { id: storyId },
-    select: { projectId: true },
-  });
-  if (!story) throw new Error("需求不存在");
-  await assertProjectMembership(story.projectId, userId);
-  return story.projectId;
-}
 
 export const listStoryReactionsFn = createServerFn({ method: "GET" })
   .validator(z.object({ storyId: z.string() }))
@@ -52,7 +31,8 @@ export const listStoryReactionsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
+    await assertStoryProjectMember(data.storyId, userId);
 
     const reactions = await prisma.storyReaction.findMany({
       where: { storyId: data.storyId },
@@ -68,7 +48,7 @@ export const addStoryReactionFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 
@@ -100,7 +80,7 @@ export const toggleStoryReactionFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertStoryProjectMember(data.storyId, userId);
 
@@ -136,7 +116,7 @@ export const toggleCommentReactionFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // 反查评论所属需求的项目成员资格（SEC-03：防对他人需求评论表态）
     const comment = await prisma.storyComment.findUnique({

package/src/server/serverFns/story/story-search.ts

@@ -28,7 +28,7 @@ export const searchStoriesFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     // R11：可选 projectId scope（BUG 详情关联需求选择器按 bug 所属项目搜索）。
     // 不传保持既有行为（用户独立项目）；传无效/非成员项目时
     // resolveStoryScopeProjectId 静默回退独立项目，与列表 scope 解析同口径。
@@ -77,7 +77,7 @@ export const reorderStoriesFn = createServerFn({ method: "POST" })
     // 可见性过滤进 where（SEC-03：防跨项目改他人需求排序）；updateMany 对
     // 越权/不存在 id 静默跳过，不中断整批合法排序
     const memberships = await prisma.projectMember.findMany({
-      where: { userId: session.user!.id!, status: { not: "suspended" } },
+      where: { userId: session.user.id, status: { not: "suspended" } },
       select: { projectId: true },
     });
     const visibleProjectIds = memberships.map((m) => m.projectId);