@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/story/story-transfer.ts

@@ -27,20 +27,13 @@ import { resolveStoryScopeProjectId } from "@/server/builtin-project";
 import { withCollabGuard } from "@/server/collab/write-guard";
 import { STORY_LIST_SELECT, castStoryUsers, castUserBrief, USER_BRIEF_SELECT, checkDescendant } from "@/server/story/types";
 import { withSequenceNumberRetry } from "@/server/lib/sequence-number-retry";
+import { assertProjectMembership as assertProjectMembershipShared } from "@/server/lib/project-membership";
 
 type StoryTx = Parameters<Parameters<typeof import("@allbluecn/database").prisma.$transaction>[0]>[0];
 
-/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的需求");
-  }
-}
+/** 项目有效成员校验（共享口径见 server/lib/project-membership：suspended 视同无权限） */
+const assertProjectMembership = (projectId: string, userId: string) =>
+  assertProjectMembershipShared(projectId, userId, "无权限操作该项目的需求");
 
 async function collectDescendantIds(storyId: string): Promise<Set<string>> {
   const prisma = await getPrisma();
@@ -150,7 +143,7 @@ export const transferStoryToProjectFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     return runTransferWithIdentifierRetry(async (tx) => {
       const existing = await tx.story.findUnique({
@@ -237,7 +230,7 @@ export const transferStoryAsChildFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     if (data.storyId === data.parentStoryId) {
       throw new Error("不能将需求设为自身的子需求");
@@ -443,7 +436,7 @@ export const listProjectStoriesFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // 读门槛与列表 scope 同口径（SEC-03）：传 projectId 走 resolveStoryScopeProjectId
     // （非成员静默回退独立项目）；不传（「全部项目」选择器）只返回用户为有效成员的项目

package/src/server/serverFns/story/story-tree.ts

@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+// getStoryTreeFn / getChildrenCountFn 已删除（审计 2026-10-25）：零 UI 引用的死 GET 通道，且前者
+// 无 rootId 时返回全部项目的根需求全字段（跨项目泄露）、二者均无成员校验。可从 git 恢复。
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
@@ -22,48 +24,8 @@ import { z } from "zod";
 import { buildRoomName } from "@allbluecn/collab-core/rooms";
 import { requireAuth } from "@/server/auth-helpers";
 import { withCollabGuard } from "@/server/collab/write-guard";
-import { buildStoryTree, checkDescendant } from "@/server/story/types";
-
-/** 项目有效成员校验（口径同 testcase-crud / deleteBugFn：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的需求");
-  }
-}
-
-export const getStoryTreeFn = createServerFn({ method: "GET" })
-  .validator(z.object({ rootId: z.string().optional() }))
-  .handler(async ({ data }) => {
-    const prisma = await getPrisma()
-    const request = getRequest();
-    await requireAuth(request);
-
-    const rootStories = await prisma.story.findMany({
-      where: data.rootId ? { id: data.rootId } : { parentId: null },
-      include: {
-        children: {
-          include: {
-            children: {
-              include: {
-                children: true,
-              },
-            },
-          },
-        },
-      },
-    });
-
-    const tree = await Promise.all(
-      rootStories.map(async (story) => buildStoryTree(story)),
-    );
-
-    return tree;
-  });
+import { checkDescendant } from "@/server/story/types";
+import { assertStoryProjectMembership as assertProjectMembership } from "@/server/story/permissions";
 
 export const addChildFn = createServerFn({ method: "POST" })
   .validator(z.object({ parentId: z.string(), childId: z.string() }))
@@ -71,7 +33,7 @@ export const addChildFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const existingChild = await prisma.story.findUnique({
       where: { id: data.childId },
@@ -162,7 +124,7 @@ export const removeChildFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const existing = await prisma.story.findUnique({
       where: { id: data.childId },
@@ -200,17 +162,3 @@ export const removeChildFn = createServerFn({ method: "POST" })
 
     return child;
   });
-
-export const getChildrenCountFn = createServerFn({ method: "GET" })
-  .validator(z.object({ parentId: z.string() }))
-  .handler(async ({ data }) => {
-    const prisma = await getPrisma()
-    const request = getRequest();
-    await requireAuth(request);
-
-    const count = await prisma.story.count({
-      where: { parentId: data.parentId },
-    });
-
-    return { count };
-  });

package/src/server/serverFns/story-display-options.ts

@@ -19,11 +19,11 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start"
 import { getRequest } from "@tanstack/react-start/server"
-import { z } from "zod"
 import { requireAuth } from "@/server/auth-helpers"
 import { requireFeature } from "@/server/entitlements"
 import { isProEdition } from "@/server/pro-services"
-import type { Prisma } from "@allbluecn/database";
+import { toJsonInput } from "@/server/lib/prisma-json"
+import { displayOptionsSchema } from "@/server/lib/display-options-schema"
 import {
   DEFAULT_DISPLAY_OPTIONS,
   GROUP_KEYS,
@@ -31,7 +31,7 @@ import {
   ORDER_DIRECTIONS,
   ALL_DISPLAY_PROPERTIES,
   PAGE_SIZE_OPTIONS,
-} from "@/components/shared-kit/list-kit/display/values"
+} from "@/shared/list-kit/display-values"
 import type {
   DisplayOptions,
   DisplayProperty,
@@ -39,12 +39,7 @@ import type {
   OrderKey,
   OrderDirection,
   PageSize,
-} from "@/components/shared-kit/list-kit/display/types"
-
-/** Prisma Json 字段不接受强类型对象（缺 index signature），统一 cast */
-function toJson<T>(value: T): Prisma.InputJsonValue {
-  return value as unknown as Prisma.InputJsonValue
-}
+} from "@/shared/list-kit/display-types"
 
 /** 解析存储的 JSON 偏好，非法/缺失字段回退默认值 */
 function parseStoredOptions(raw: unknown): DisplayOptions {
@@ -103,26 +98,8 @@ function parseStoredOptions(raw: unknown): DisplayOptions {
   }
 }
 
-const groupBySchema = z.enum([...GROUP_KEYS, "iteration"] as const)
-const subGroupBySchema = z.enum(GROUP_KEYS)
-const orderBySchema = z.enum(ORDER_KEYS)
-const orderDirSchema = z.enum(ORDER_DIRECTIONS)
-const propertySchema = z.enum(ALL_DISPLAY_PROPERTIES)
-const pageSizeSchema = z.union([z.literal(100), z.literal(200), z.literal(500), z.literal(1000)])
-
-// 模块私有：serverFn 文件只准导出 createServerFn（客户端 split 会保留普通导出，
-// 与本文件顶层 @/server/* import 叠加会把服务端依赖拉进浏览器 bundle）
-const displayOptionsSchema = z.object({
-  groupBy: groupBySchema,
-  subGroupBy: subGroupBySchema,
-  orderBy: orderBySchema,
-  orderDir: orderDirSchema,
-  properties: z.array(propertySchema),
-  showEmptyGroups: z.boolean(),
-  showSubItems: z.boolean(),
-  pageSize: pageSizeSchema,
-  columnOrder: z.array(z.string().min(1)).optional(),
-})
+// 写入侧校验 schema 已收敛到 @/server/lib/display-options-schema（与
+// story-view.ts 共用单一来源，审计 🔵/🟡 2026-10-25）
 
 /** 获取当前用户持久化的 Display Options（非法/缺失字段已回退默认值） */
 export const getStoryDisplayOptionsFn = createServerFn({ method: "GET" }).handler(
@@ -130,7 +107,7 @@ export const getStoryDisplayOptionsFn = createServerFn({ method: "GET" }).handle
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
 
     const user = await prisma.user.findUnique({
       where: { id: userId },
@@ -162,7 +139,7 @@ export const updateStoryDisplayOptionsFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
 
     // 服务端强制校验：pageSize > 200（500/1000）为 Pro 专属，前端锁定只是 UX
     // OSS 环境直接 cap 到 200；Pro 环境走 feature gate
@@ -177,7 +154,7 @@ export const updateStoryDisplayOptionsFn = createServerFn({ method: "POST" })
     const options: DisplayOptions = data
     await prisma.user.update({
       where: { id: userId },
-      data: { storyDisplayOptions: toJson(options) },
+      data: { storyDisplayOptions: toJsonInput(options) },
     })
     return options
   })

package/src/server/serverFns/story-view.ts

@@ -20,15 +20,12 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
-import { toSavedView, type SavedView } from "@/components/story/views/view-types";
+import { toJsonInput } from "@/server/lib/prisma-json";
+import { displayOptionsSchema } from "@/server/lib/display-options-schema";
+import { toSavedView } from "@/components/story/views/view-types";
 import type { FilterCondition } from "@/components/story/filters/field-configs";
-import type { DisplayOptions } from "@/components/shared-kit/list-kit/display/types";
 import type { Prisma } from "@allbluecn/database";
 
-function toJson<T>(value: T): Prisma.InputJsonValue {
-  return value as unknown as Prisma.InputJsonValue;
-}
-
 const SELECT = {
   id: true,
   userId: true,
@@ -47,13 +44,13 @@ export const listStoryViewsFn = createServerFn({ method: "GET" }).handler(async
     const prisma = await getPrisma()
   const request = getRequest();
   const session = await requireAuth(request);
-  const userId = session.user!.id!;
+  const userId = session.user.id;
   const rows = await prisma.storyFilterView.findMany({
     where: { userId },
     orderBy: { sortOrder: "asc" },
     select: SELECT,
   });
-  return rows.map((r: any) => toSavedView(r));
+  return rows.map((r) => toSavedView(r));
 });
 
 const filterConditionSchema = z.object({
@@ -69,6 +66,10 @@ const createSchema = z.object({
   icon: z.string().default("list"),
   projectId: z.string().optional(),
   filters: z.array(filterConditionSchema),
+  // 审计 🟡（2026-10-25）：displayOptions 曾 z.unknown() 任意 JSON 直通入库；
+  // 写入侧在 handler 内按 displayOptionsSchema.parse 强校验（放 validator 会把
+  // 完整 DisplayOptionsInput 泄漏成客户端 RPC 参数类型，迫使 story-list-view
+  // 等消费方改类型——该文件属并行组件批次范围，故校验收敛在 handler）
   displayOptions: z.unknown(),
 });
 
@@ -78,7 +79,9 @@ export const createStoryViewFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
+    // 写入闸门：非法形状（缺 orderDir/pageSize 等）在落库前被拒
+    const displayOptions = displayOptionsSchema.parse(data.displayOptions);
     const row = await prisma.storyFilterView.create({
       data: {
         userId,
@@ -86,8 +89,8 @@ export const createStoryViewFn = createServerFn({ method: "POST" })
         description: data.description ?? null,
         icon: data.icon,
         projectId: data.projectId ?? null,
-        filters: toJson(data.filters as FilterCondition[]),
-        displayOptions: toJson(data.displayOptions as unknown as DisplayOptions),
+        filters: toJsonInput(data.filters as FilterCondition[]),
+        displayOptions: toJsonInput(displayOptions),
       },
       select: SELECT,
     });
@@ -110,15 +113,17 @@ export const updateStoryViewFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     const { id, ...patch } = data;
     const data2: Record<string, unknown> = {};
     if (patch.name !== undefined) data2.name = patch.name;
     if (patch.description !== undefined) data2.description = patch.description;
     if (patch.icon !== undefined) data2.icon = patch.icon;
     if (patch.projectId !== undefined) data2.projectId = patch.projectId;
-    if (patch.filters !== undefined) data2.filters = toJson(patch.filters as FilterCondition[]);
-    if (patch.displayOptions !== undefined) data2.displayOptions = toJson(patch.displayOptions as unknown as DisplayOptions);
+    if (patch.filters !== undefined) data2.filters = toJsonInput(patch.filters as FilterCondition[]);
+    if (patch.displayOptions !== undefined) {
+      data2.displayOptions = toJsonInput(displayOptionsSchema.parse(patch.displayOptions));
+    }
     const row = await prisma.storyFilterView.update({
       where: { id, userId },
       data: data2,
@@ -135,9 +140,7 @@ export const deleteStoryViewFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await prisma.storyFilterView.delete({ where: { id: data.id, userId } });
     return { success: true };
   });
-
-export type { SavedView };

package/src/server/serverFns/tasks/task-crud.ts

@@ -156,7 +156,7 @@ export const createAiTaskFn = createServerFn({ method: "POST" })
   .handler(async ({ data }): Promise<{ id: string; runId?: string }> => {
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     assertPgOnlyMutation();
 
@@ -228,7 +228,7 @@ export const runAiTaskFn = createServerFn({ method: "POST" })
   .handler(async ({ data }): Promise<{ runId: string }> => {
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     assertPgOnlyMutation();
     await checkAiRateLimit(userId, "aiTask");
@@ -243,7 +243,7 @@ export const deleteAiTaskFn = createServerFn({ method: "POST" })
   .handler(async ({ data }): Promise<{ ok: true }> => {
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     assertPgOnlyMutation();
 

package/src/server/serverFns/tasks/task-queries.ts

@@ -68,7 +68,7 @@ export const listAssignedToMeFn = createServerFn({ method: "GET" }).handler(
   async (): Promise<AssignedResult> => {
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     return fetchAssignedToMe(userId);
   },
@@ -80,7 +80,7 @@ export const listAiTasksFn = createServerFn({ method: "GET" }).handler(
   async () => {
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // 桌面端 SQLite 无 aiTask 表（pg-only）：降级空列表并声明 degraded，不触 DB
     if (getDatabaseProvider() === "sqlite") {
@@ -132,7 +132,7 @@ export const getAiTaskFn = createServerFn({ method: "GET" })
   }> => {
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const prisma = await getPrisma();
 

package/src/server/serverFns/team.ts

@@ -9,6 +9,8 @@ import { requireTeamSeats } from '@/server/resources'
 import { auditLog } from '@/server/audit'
 import { sendTemplateEmail } from '@/server/email'
 import { USER_BRIEF_SELECT } from '@/server/team-access'
+import { getClientIp } from '@allbluecn/kernel'
+import { checkRateLimit, RateLimitExceededError } from '@/server/lib/rate-limit'
 
 const INVITE_EXPIRES_DAYS = 7
 const OWNER_SELECT = { id: true, username: true, email: true, avatarConfig: true, bgShape: true, bgColor: true } as const
@@ -34,7 +36,7 @@ export const createTeamInvitationFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const ownerId = session.user!.id!
+    const ownerId = session.user.id
 
     const email = data.channel === 'email' ? data.email!.toLowerCase() : null
 
@@ -132,7 +134,7 @@ export const listTeamInvitationsFn = createServerFn({ method: 'GET' }).handler(a
   try {
     const request = getRequest()
     const session = await requireAuth(request)
-    const ownerId = session.user!.id!
+    const ownerId = session.user.id
     const now = new Date()
 
     await prisma.teamInvitation.updateMany({
@@ -190,7 +192,7 @@ export const clearExpiredInvitationsFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const ownerId = session.user!.id!
+    const ownerId = session.user.id
     const res = await prisma.teamInvitation.deleteMany({
       where: { ownerId, status: 'expired', channel: 'email' },
     })
@@ -211,7 +213,7 @@ export const revokeTeamInvitationFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const ownerId = session.user!.id!
+    const ownerId = session.user.id
     // DB-03：属主校验并入单次 findFirst（消除查后比对二次往返与 TOCTOU），文案保持
     const inv = await assertOwned(prisma.teamInvitation, { where: { id: data.invitationId, ownerId } }, '邀请不存在')
     if (inv.status !== 'pending' && inv.status !== 'pending_approval') throw new Error('仅待处理/待批准邀请可撤销')
@@ -241,7 +243,7 @@ export const resendTeamInvitationFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const ownerId = session.user!.id!
+    const ownerId = session.user.id
     // DB-03：属主校验并入单次 findFirst（消除查后比对二次往返与 TOCTOU），文案保持
     const inv = await assertOwned(prisma.teamInvitation, { where: { id: data.invitationId, ownerId } }, '邀请不存在')
     if (inv.status !== 'pending' && inv.status !== 'expired') {
@@ -285,7 +287,7 @@ export const refreshTeamInvitationLinkFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const ownerId = session.user!.id!
+    const ownerId = session.user.id
 
     await requireTeamSeats(ownerId, 'member', 1)
 
@@ -335,7 +337,7 @@ export const listTeamMembersFn = createServerFn({ method: 'GET' }).handler(async
     const prisma = await getPrisma()
   const request = getRequest()
   const session = await requireAuth(request)
-  const ownerId = session.user!.id!
+  const ownerId = session.user.id
 
   // 以 memberId 判当前用户的归属：避免为已是别家成员的账号创建自引用 owner 记录（P2002）
   const ownEntry = await prisma.teamMembership.findUnique({
@@ -381,7 +383,7 @@ export const removeTeamMemberFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const ownerId = session.user!.id!
+    const ownerId = session.user.id
     const m = await prisma.teamMembership.findUnique({ where: { id: data.membershipId } })
     if (!m) throw new Error('成员不存在')
     if (m.ownerId !== ownerId) throw new Error('权限不足：仅团队所有者可移除成员')
@@ -403,7 +405,7 @@ export const leaveTeamFn = createServerFn({ method: 'POST' }).validator(z.object
     const prisma = await getPrisma()
   const request = getRequest()
   const session = await requireAuth(request)
-  const userId = session.user!.id!
+  const userId = session.user.id
   const m = await prisma.teamMembership.findUnique({ where: { memberId: userId } })
   if (!m) throw new Error('你未加入任何团队')
   await prisma.$transaction(async (tx) => {
@@ -433,7 +435,7 @@ export const approveTeamJoinRequestFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const ownerId = session.user!.id!
+    const ownerId = session.user.id
 
     // DB-03：属主校验并入单次 findFirst（include 关系一并取回）。
     // 此处内联 findFirst 而非 assertOwned：include 投影类型（reqRow.invitation）需走
@@ -502,7 +504,7 @@ export const rejectTeamJoinRequestFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const ownerId = session.user!.id!
+    const ownerId = session.user.id
 
     // DB-03：属主校验并入单次 findFirst
     const reqRow = await assertOwned(prisma.teamJoinRequest, { where: { id: data.requestId, ownerId } }, '申请不存在')
@@ -530,7 +532,7 @@ export const deleteTeamInvitationFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const ownerId = session.user!.id!
+    const ownerId = session.user.id
 
     // DB-03：属主校验并入单次 findFirst
     const invRow = await assertOwned(prisma.teamInvitation, { where: { id: data.invitationId, ownerId } }, '邀请不存在')
@@ -556,7 +558,7 @@ export const deleteTeamJoinRequestFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const ownerId = session.user!.id!
+    const ownerId = session.user.id
 
     // DB-03：属主校验并入单次 findFirst
     const reqRow = await assertOwned(prisma.teamJoinRequest, { where: { id: data.requestId, ownerId } }, '申请不存在')
@@ -578,7 +580,7 @@ export const listTeamUsersFn = createServerFn({ method: 'GET' }).handler(async (
     const prisma = await getPrisma()
   const request = getRequest()
   const session = await requireAuth(request)
-  const userId = session.user!.id!
+  const userId = session.user.id
   const joined = await prisma.teamMembership.findUnique({ where: { memberId: userId } })
   const ownerId = joined ? joined.ownerId : userId
   const [owner, members] = await Promise.all([
@@ -678,9 +680,31 @@ export const getTeamInvitationByTokenFn = createServerFn({ method: 'GET' })
   })
 
 export const checkInviteEmailRegisteredFn = createServerFn({ method: 'POST' })
-  .validator(z.object({ email: z.string().email() }))
+  // 审计 A5x-5 🟠：无鉴权端点曾可任意枚举注册邮箱——现绑定有效邀请 token + IP 限流
+  .validator(z.object({ token: z.string().min(1), email: z.string().email() }))
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
+    let ip: string | null = null
+    try {
+      ip = getClientIp(getRequest())
+    } catch {
+      // IP 取不到归入 unknown 桶，仍受限流保护
+    }
+    const rl = checkRateLimit(
+      `invite-email-check:${ip ?? 'unknown'}`,
+      { max: 30, windowMs: 15 * 60 * 1000 },
+    )
+    if (!rl.allowed) throw new RateLimitExceededError(rl.retryAfterMs, 'inviteEmailCheck')
+
+    const inv = await prisma.teamInvitation.findUnique({
+      where: { token: data.token },
+      select: { status: true, channel: true, expiresAt: true },
+    })
+    const invValid = inv
+      && (inv.status === 'pending' || (inv.channel === 'email' && inv.status === 'pending_approval'))
+      && (!inv.expiresAt || inv.expiresAt > new Date())
+    if (!invValid) throw new Error('邀请链接无效或已过期')
+
     const user = await prisma.user.findUnique({
       where: { email: data.email.toLowerCase() },
       select: { id: true },
@@ -777,12 +801,12 @@ export const acceptTeamInvitationFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
     const currentUser = await prisma.user.findUnique({
       where: { id: userId },
       select: { email: true },
     })
-    const email = (currentUser?.email ?? session.user!.email ?? '').toLowerCase()
+    const email = (currentUser?.email ?? session.user.email ?? '').toLowerCase()
     if (!email) throw new Error('当前账号缺少邮箱，无法申请')
 
     const inv = await prisma.teamInvitation.findUnique({ where: { token: data.token } })
@@ -845,7 +869,7 @@ export const approveTeamInvitationFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const ownerId = session.user!.id!
+    const ownerId = session.user.id
 
     // DB-03：属主校验并入单次 findFirst
     const inv = await assertOwned(prisma.teamInvitation, { where: { id: data.invitationId, ownerId } }, '邀请不存在')

package/src/server/serverFns/testcase/__tests__/generation.test.ts

@@ -305,7 +305,7 @@ describe("startGenerationFn", () => {
     expect(opts.promptVars.storyContext).toContain("AC1");
   });
 
-  it("kbDocIds 组装 kbContext（docId+excerpt 截断），非本人知识库文档被过滤", async () => {
+  it("kbDocIds 组装 kbContext（docId+excerpt 截断），归属过滤下推 DB（kb.userId）", async () => {
     DB.storyFindUnique.mockResolvedValue({
       id: "s-1",
       projectId: P,
@@ -313,14 +313,13 @@ describe("startGenerationFn", () => {
       description: STORY_DESC,
     });
     DB.caseFindMany.mockResolvedValue([]);
+    // 过滤在 where 内完成（mock 模拟 DB 行为）：仅返回本人 KB 文档
     DB.kbDocFindMany.mockResolvedValue([
       {
         id: "kbdoc-1",
         title: "API 约定",
         content: { markdown: "接口鉴权使用 Bearer Token".repeat(3000) },
-        kb: { userId: U },
       },
-      { id: "kbdoc-2", title: "他人文档", content: { markdown: "秘密" }, kb: { userId: "other" } },
     ]);
     DB.runCreate.mockResolvedValue(runRow());
     M.runChatAsAgent.mockResolvedValue(JSON.stringify(validOutput()));
@@ -328,9 +327,15 @@ describe("startGenerationFn", () => {
 
     await startGenerationFn({ data: { storyId: "s-1", kbDocIds: ["kbdoc-1", "kbdoc-2"] } });
 
+    // 归属过滤下推 DB（审计 ⚪）：where 含 kb.userId，他人文档整行不再进内存
     expect(DB.kbDocFindMany).toHaveBeenCalledWith(
       expect.objectContaining({
-        where: { id: { in: ["kbdoc-1", "kbdoc-2"] }, isDeleted: false },
+        where: {
+          id: { in: ["kbdoc-1", "kbdoc-2"] },
+          isDeleted: false,
+          kb: { userId: U },
+        },
+        select: { id: true, title: true, content: true },
       }),
     );
     const createdInput = DB.runCreate.mock.calls[0]![0]!.data.input as {

package/src/server/serverFns/testcase/__tests__/plans.test.ts

@@ -262,6 +262,7 @@ describe("createPlanFn", () => {
 
 describe("getPlanFn", () => {
   it("详情含用例集（含 deprecated 仍列出）且 deprecatedCount 正确计数", async () => {
+    memberOk();
     DB.planFindUnique.mockResolvedValue(
       planRow({
         planCases: [

package/src/server/serverFns/testcase/__tests__/regression.test.ts

@@ -226,6 +226,21 @@ describe("getBugRegressionStatusFn", () => {
     expect(res.regression!.completedAt).toBe("2026-03-01T00:00:00.000Z");
   });
 
+  it("completed 但 completedAt=null 的脏数据 → regression null（审计 🟡：不产出 null 完成时间）", async () => {
+    DB.runCaseFindMany.mockResolvedValue([linkedCase("c1")]);
+    DB.runFindFirst.mockResolvedValue({
+      id: "run-dirty-time",
+      name: "回归验证：登录页空指针",
+      completedAt: null,
+      summary: { total: 3, passed: 3, failed: 0 },
+    });
+
+    const res = (await getBugRegressionStatusFn({ data: { bugId: BUG } })) as {
+      regression: unknown;
+    };
+    expect(res.regression).toBeNull();
+  });
+
   it("最近 completed Run 有失败（passed < total）→ regression null（失败覆盖旧绿）", async () => {
     DB.runCaseFindMany.mockResolvedValue([linkedCase("c1")]);
     DB.runFindFirst.mockResolvedValue({