@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/testcase/__tests__/run-cases.test.ts

@@ -36,6 +36,8 @@ const H = vi.hoisted(() => {
   const db = {
     runFindUnique: vi.fn(),
     runUpdate: vi.fn(),
+    // finalize arbiter（审计 🟡）：run 落账改条件 updateMany
+    runUpdateMany: vi.fn(),
     runCaseFindUnique: vi.fn(),
     runCaseFindMany: vi.fn(),
     runCaseUpdate: vi.fn(),
@@ -45,7 +47,7 @@ const H = vi.hoisted(() => {
     transaction: vi.fn(),
   };
   const prisma = {
-    testRun: { findUnique: db.runFindUnique, update: db.runUpdate },
+    testRun: { findUnique: db.runFindUnique, update: db.runUpdate, updateMany: db.runUpdateMany },
     testRunCase: {
       findUnique: db.runCaseFindUnique,
       findMany: db.runCaseFindMany,
@@ -161,6 +163,7 @@ beforeEach(() => {
   M.requireAuth.mockResolvedValue({ user: { id: U } });
   DB.runCaseUpdate.mockResolvedValue(runCaseRow());
   DB.runUpdate.mockResolvedValue(runRow());
+  DB.runUpdateMany.mockResolvedValue({ count: 1 });
   DB.transaction.mockImplementation(async (input: unknown) => {
     if (typeof input === "function") {
       return (input as (tx: typeof PRISMA) => Promise<unknown>)(PRISMA);
@@ -364,12 +367,12 @@ describe("reportResultFn", () => {
       executedById: U,
       finishedAt: expect.any(Date),
     });
-    // 契约：finalize 在 RunCase update 之后、同一事务内
-    expect(DB.runUpdate.mock.invocationCallOrder[0]).toBeGreaterThan(
+    // 契约：finalize 在 RunCase update 之后、同一事务内（arbiter 走条件 updateMany）
+    expect(DB.runUpdateMany.mock.invocationCallOrder[0]).toBeGreaterThan(
       DB.runCaseUpdate.mock.invocationCallOrder[0]!,
     );
-    expect(DB.runUpdate).toHaveBeenCalledWith({
-      where: { id: "run-1" },
+    expect(DB.runUpdateMany).toHaveBeenCalledWith({
+      where: { id: "run-1", status: "running" },
       data: expect.objectContaining({
         status: "completed",
         completedAt: expect.any(Date),
@@ -390,7 +393,7 @@ describe("reportResultFn", () => {
       data: { runCaseId: "rc-1", status: "blocked", actualResult: "环境挂了" },
     })) as unknown as { completed: boolean; summary: unknown };
 
-    expect(DB.runUpdate).not.toHaveBeenCalled();
+    expect(DB.runUpdateMany).not.toHaveBeenCalled();
     // 活动门控：仅 run 真正落账 completed 时记一次，普通回报零活动
     expect(DB.projectActivityCreate).not.toHaveBeenCalled();
     expect(out).toEqual({ success: true, completed: false, summary: null });
@@ -617,6 +620,7 @@ describe("addEvidenceFn", () => {
 
 describe("getRunCaseFn", () => {
   it("返回执行负载（stepResults cast、日期转 ISO）", async () => {
+    memberOk();
     DB.runCaseFindUnique.mockResolvedValue(
       runCaseRow({
         status: "passed",
@@ -625,6 +629,7 @@ describe("getRunCaseFn", () => {
         durationMs: 8000,
         startedAt: DATE,
         finishedAt: DATE,
+        run: { projectId: "p1" },
       }),
     );
 

package/src/server/serverFns/testcase/__tests__/runs.test.ts

@@ -540,6 +540,7 @@ describe("abortRunFn", () => {
 
 describe("getRunFn", () => {
   it("详情含 cases（快照/状态/执行人），日期转 ISO", async () => {
+    memberOk();
     DB.runFindUnique.mockResolvedValue(
       runRow({
         status: "completed",
@@ -601,6 +602,7 @@ describe("getRunFn", () => {
   });
 
   it("批次不存在时抛中文错误", async () => {
+    memberOk();
     DB.runFindUnique.mockResolvedValue(null);
 
     await expect(getRunFn({ data: { id: "run-404" } })).rejects.toThrow("执行批次不存在");

package/src/server/serverFns/testcase/__tests__/testgen-output.test.ts

@@ -264,7 +264,7 @@ describe("runChatAsAgent('testgen') mock 链路", () => {
   })
 
   it("固定 JSON 产物经 outputSchema 解析通过，promptKey 映射到内置模板", async () => {
-    adapterMocks.runChatWithModel.mockResolvedValue(JSON.stringify(validOutput()))
+    adapterMocks.runChat.mockResolvedValue(JSON.stringify(validOutput()))
 
     const raw = await runChatAsAgent(
       "testgen",
@@ -283,7 +283,7 @@ describe("runChatAsAgent('testgen') mock 链路", () => {
     const parsed = TestGenerationOutputSchema.parse(JSON.parse(raw))
     expect(parsed.groups[0]!.cases[0]!.title).toBe("提交合法表单成功")
 
-    const call = adapterMocks.runChatWithModel.mock.calls[0]![1]!
+    const call = adapterMocks.runChat.mock.calls[0]![1]!
     // bizKey → prompt key 映射 + DB 缺行回落内置，系统提示词含插值与 persona
     const systemPrompts = call.systemPrompts as string[]
     expect(systemPrompts.join("\n")).toContain("【需求上下文】AC1：登录成功")
@@ -298,7 +298,7 @@ describe("runChatAsAgent('testgen') mock 链路", () => {
     ;(
       bad.groups[0]!.cases[0] as unknown as { priority: string }
     ).priority = "urgent"
-    adapterMocks.runChatWithModel.mockResolvedValue(JSON.stringify(bad))
+    adapterMocks.runChat.mockResolvedValue(JSON.stringify(bad))
 
     const raw = await runChatAsAgent(
       "testgen",

package/src/server/serverFns/testcase/automation.ts

@@ -62,23 +62,16 @@ import {
   specFileName,
   type ArtifactKind,
 } from "./automation-schema";
+import { assertProjectMembership as assertProjectMembershipShared } from "@/server/lib/project-membership";
 
 /** 重生成轮数上限（简报口径 attempts≤2：首轮 + lastError 回喂一轮） */
 const MAX_ATTEMPTS = 2;
 /** e2e 验证缺省目标环境（可用 TESTCASE_E2E_BASE_URL 覆盖；端口 3000 = 项目根 web 约定） */
 const DEFAULT_E2E_BASE_URL = "http://localhost:3000";
 
-/** 项目有效成员校验（口径同 generation.ts：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的测试模块");
-  }
-}
+/** 项目有效成员校验（共享口径见 server/lib/project-membership：suspended 视同无权限） */
+const assertProjectMembership = (projectId: string, userId: string) =>
+  assertProjectMembershipShared(projectId, userId, "无权限操作该项目的测试模块");
 
 /** 用例步骤 → 可读文本（prompt 上下文；结构 { steps: [{order, action, expected?}] }） */
 function stepsToText(steps: unknown): string {
@@ -184,7 +177,7 @@ export const generateArtifactFn = createServerFn({ method: "POST" })
     await requireFeature(getRequest(), "testGeneration");
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await checkAiRateLimit(userId, "testGeneration");
 
     if (!(await hasAiKey(userId))) {
@@ -339,7 +332,7 @@ export const adoptArtifactFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     const prisma = await getPrisma();
 
     const artifact = await prisma.testAutomationArtifact.findUnique({
@@ -389,7 +382,7 @@ export const rejectArtifactFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     const prisma = await getPrisma();
 
     const artifact = await prisma.testAutomationArtifact.findUnique({
@@ -418,7 +411,7 @@ export const listArtifactsFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     const prisma = await getPrisma();
 
     const testCase = await prisma.testCase.findUnique({

package/src/server/serverFns/testcase/bulk.ts

@@ -51,7 +51,7 @@ export const bulkArchiveTestCasesFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const visibleProjectIds = await accessibleProjectIds(session.user!.id!);
+    const visibleProjectIds = await accessibleProjectIds(session.user.id);
     const result = await prisma.testCase.updateMany({
       where: {
         id: { in: data.caseIds },
@@ -70,7 +70,7 @@ export const bulkDeleteTestCasesFn = createServerFn({ method: "POST" })
     const request = getRequest();
     const session = await requireAuth(request);
     // 可见性过滤进 where：跨项目 id 静默跳过而非报错（SEC-03/DB-03：单语句消除跨项目删除）
-    const visibleProjectIds = await accessibleProjectIds(session.user!.id!);
+    const visibleProjectIds = await accessibleProjectIds(session.user.id);
     const result = await prisma.testCase.deleteMany({
       where: { id: { in: data.caseIds }, projectId: { in: visibleProjectIds } },
     });
@@ -98,7 +98,7 @@ export const bulkUpdateTestCasesFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     const visibleProjectIds = await accessibleProjectIds(userId);
 
     const data_: Record<string, unknown> = {};

package/src/server/serverFns/testcase/generation.ts

@@ -32,6 +32,7 @@ import type { Prisma } from "@allbluecn/database";
 import { requireAuth } from "@/server/auth-helpers";
 import { requireFeature } from "@/server/entitlements";
 import { checkAiRateLimit } from "@/server/lib/rate-limit";
+import { truncateWithMarker } from "@/server/lib/text-truncate";
 import { hasAiKey } from "@/server/ai-gateway/adapter";
 import { runChatAsAgent } from "@/server/ai-gateway/runs/agent-runtime";
 import {
@@ -41,18 +42,7 @@ import {
   type TestGenerationOutput,
 } from "./generation-schema";
 import { TEST_CASE_IDENTIFIER_PREFIX } from "./constants";
-
-/** 项目有效成员校验（口径同 testcase-crud：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的测试模块");
-  }
-}
+import { assertTestProjectMembership as assertProjectMembership } from "@/server/testcase/permissions";
 
 // ── description 纯文本化（与 lib/story/description-diff.ts 兼容口径一致的三形态：
 // JSON 主格式 {html, markdown} / 裸 HTML / 纯文本。文件内私有防 serverFn 模块混装）──
@@ -116,14 +106,14 @@ async function buildKbContext(
 ): Promise<KbExcerpt[]> {
   if (kbDocIds.length === 0) return [];
   const prisma = await getPrisma();
+  // 归属过滤下推 DB（审计 ⚪：他人文档 content 大字段不再整行拉进内存再丢弃）
   const docs = await prisma.knowledgeDocument.findMany({
-    where: { id: { in: kbDocIds }, isDeleted: false },
-    select: { id: true, title: true, content: true, kb: { select: { userId: true } } },
+    where: { id: { in: kbDocIds }, isDeleted: false, kb: { userId } },
+    select: { id: true, title: true, content: true },
   });
   const excerpts: KbExcerpt[] = [];
   let total = 0;
   for (const doc of docs) {
-    if (doc.kb.userId !== userId) continue;
     const text = contentToPlainText(doc.content) || doc.title;
     if (!text.trim()) continue;
     const excerpt = text.slice(0, KB_PER_DOC_CHAR_LIMIT);
@@ -232,6 +222,22 @@ function errMessage(err: unknown): string {
   return err instanceof Error ? err.message : String(err);
 }
 
+/**
+ * run.error 落库前脱敏（审计 🟡：AI/provider 原始 message 可能含内部 URL、模型名、
+ * 上游报错细节，随 getGenerationFn 回显给项目成员）。策略：剥离 http(s) URL +
+ * 折叠空白 + truncateWithMarker 截断（@/server/lib/text-truncate 既有 AI 错误
+ * 落库口径），保留错误类别与摘要供前端展示与重试决策。
+ */
+const RUN_ERROR_MAX_LENGTH = 300;
+
+function sanitizeRunError(err: unknown): string {
+  const raw = errMessage(err)
+    .replace(/https?:\/\/\S+/g, "（URL 已隐藏）")
+    .replace(/\s+/g, " ")
+    .trim();
+  return truncateWithMarker(raw, RUN_ERROR_MAX_LENGTH);
+}
+
 // ── 启动生成批次 ──
 
 const startGenerationInputSchema = z.object({
@@ -246,7 +252,7 @@ export const startGenerationFn = createServerFn({ method: "POST" })
     await requireFeature(getRequest(), "testGeneration");
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await checkAiRateLimit(userId, "testGeneration");
 
     if (!(await hasAiKey(userId))) {
@@ -393,10 +399,10 @@ export const startGenerationFn = createServerFn({ method: "POST" })
         drafts: createdDrafts.map(castDraft),
       };
     } catch (err) {
-      // AI 失败降级：置 failed + error，不抛给前端（返回 run 记录可重试）
+      // AI 失败降级：置 failed + error（脱敏后），不抛给前端（返回 run 记录可重试）
       const failed = await prisma.testGenerationRun.update({
         where: { id: run.id },
-        data: { status: "failed", error: errMessage(err), completedAt: new Date() },
+        data: { status: "failed", error: sanitizeRunError(err), completedAt: new Date() },
       });
       return { run: castRun(failed), drafts: [] as GenerationDraftDTO[] };
     }
@@ -442,7 +448,7 @@ export const adoptDraftsFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     const prisma = await getPrisma();
 
     const run = await prisma.testGenerationRun.findUnique({
@@ -532,7 +538,7 @@ export const getGenerationFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     const prisma = await getPrisma();
 
     const run = await prisma.testGenerationRun.findUnique({

package/src/server/serverFns/testcase/plans.ts

@@ -30,9 +30,9 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import type { Prisma } from "@allbluecn/database";
-import type { AvatarConfig } from "@allbluecn/kernel";
 import { requireAuth } from "@/server/auth-helpers";
 import { resolveStoryScopeProjectId } from "@/server/builtin-project";
+import { USER_BRIEF_SELECT, castUserBrief } from "@/server/story/types";
 import {
   TEST_PLAN_STATE_VALUES,
   type TestCaseState,
@@ -45,18 +45,8 @@ import type {
   TestPlanDetail,
   TestPlanSummary,
 } from "./types";
+import { assertTestPlanProjectMember, assertTestProjectMembership as assertProjectMembership } from "@/server/testcase/permissions";
 
-/** 项目有效成员校验（口径同 testcase-crud：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的测试模块");
-  }
-}
 
 /** iterationId 归属校验（防跨项目挂载，拒绝路径零写） */
 async function assertIterationInProject(projectId: string, iterationId: string | null | undefined) {
@@ -71,25 +61,7 @@ async function assertIterationInProject(projectId: string, iterationId: string |
   }
 }
 
-// ── DTO cast（user brief select 与日期 cast 文件内私有，不外导）──
-
-const USER_BRIEF_SELECT = {
-  id: true,
-  username: true,
-  email: true,
-  avatarConfig: true,
-  bgShape: true,
-  bgColor: true,
-} as const;
-
-type UserBriefRow = Prisma.UserGetPayload<{ select: typeof USER_BRIEF_SELECT }>;
-
-function castUserBrief(row: UserBriefRow) {
-  return {
-    ...row,
-    avatarConfig: (row.avatarConfig as AvatarConfig | null) ?? null,
-  };
-}
+// ── DTO cast（user brief select 复用 story 域 types 单一事实源；日期 cast 文件内私有，不外导）──
 
 /** 计划内用例投影：列表行字段够详情圈选列表渲染即可（不搬 precondition/steps 大字段） */
 const PLAN_CASE_SELECT = {
@@ -172,7 +144,7 @@ export const listPlansFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // scope 解析：未传/无效/非成员 → 静默回退独立项目，防越权查询（同 listTestCasesFn）
     const projectId = await resolveStoryScopeProjectId(data.projectId, userId);
@@ -202,7 +174,7 @@ export const createPlanFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // 未传 projectId 时回退内置独立项目（与读侧 resolve 同口径）；
     // resolve 内部已验成员资格，这里再过一次 assertProjectMembership 显式失败语义
@@ -269,7 +241,9 @@ export const getPlanFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma();
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    // 读侧与写侧同口径：须为计划所属项目的有效成员（审计 2026-10-25 读路径缺口）
+    await assertTestPlanProjectMember(data.id, session.user.id);
     const row = await prisma.testPlan.findUnique({
       where: { id: data.id },
       select: PLAN_DETAIL_SELECT,
@@ -294,7 +268,7 @@ export const updatePlanFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const existing = await prisma.testPlan.findUnique({
       where: { id: data.id },
@@ -319,7 +293,9 @@ export const updatePlanFn = createServerFn({ method: "POST" })
         where: { id: data.id },
         select: PLAN_LIST_SELECT,
       });
-      return castPlan(unchanged!);
+      // 并发删除下 unchanged 可达 null：显式报错而非非空断言掩盖（审计 ⚪）
+      if (!unchanged) throw new Error("计划不存在");
+      return castPlan(unchanged);
     }
 
     // update + 活动留痕同事务（字段惯例照 testcase-crud：action/targetType/targetId）
@@ -351,7 +327,7 @@ export const deletePlanFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const existing = await prisma.testPlan.findUnique({
       where: { id: data.id },
@@ -380,7 +356,9 @@ export const deletePlanFn = createServerFn({ method: "POST" })
 
 const addCasesSchema = z.object({
   planId: z.string().min(1),
-  caseIds: z.array(z.string().min(1)).min(1),
+  // 上限 500 与批内口径对齐（adoptDraftsInputSchema / reorderTestCasesFn 同值），
+  // 防超大数组生成大 in 查询/createMany（审计 🟡）
+  caseIds: z.array(z.string().min(1)).min(1).max(500),
 });
 
 export const addCasesToPlanFn = createServerFn({ method: "POST" })
@@ -389,7 +367,7 @@ export const addCasesToPlanFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const plan = await prisma.testPlan.findUnique({
       where: { id: data.planId },
@@ -449,7 +427,7 @@ export const removeCaseFromPlanFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const plan = await prisma.testPlan.findUnique({
       where: { id: data.planId },

package/src/server/serverFns/testcase/regression.ts

@@ -39,7 +39,6 @@ import { requireAuth } from "@/server/auth-helpers";
 import { assertBugProjectMember } from "@/server/bug/bug-permissions";
 import { createRunFn } from "./runs";
 import type { RunExecutorType } from "./constants";
-import type { TestRunCaseSkip, TestRunSummary } from "./types";
 
 /** 绿色回归徽标数据（getBugRegressionStatusFn 返回 regression 字段；null=无有效绿色裁决） */
 export type BugRegressionStatus = {
@@ -63,7 +62,7 @@ export const regressBugFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const bug = await prisma.bug.findUnique({
       where: { id: data.bugId },
@@ -86,7 +85,9 @@ export const regressBugFn = createServerFn({ method: "POST" })
     const caseIds = [...new Set(linked.map((l) => l.caseId))];
 
     // 委托 createRunFn：approved 圈选 + 快照重取现值（buildCaseSnapshot）+ 事务创建
-    // 均在其内完成；零可跑用例（全 deprecated/非 approved）由其抛中文错误
+    // 均在其内完成；零可跑用例（全 deprecated/非 approved）由其抛中文错误。
+    // createRunFn 返回类型已是 { run: TestRunSummary; skipped: TestRunCaseSkip[] }，
+    // 无需 as 强转（审计 ⚪：双重 cast 掩盖返回形状漂移）
     const { run, skipped } = await createRunFn({
       data: {
         projectId: bug.projectId,
@@ -95,7 +96,7 @@ export const regressBugFn = createServerFn({ method: "POST" })
         name: regressionRunName(bug.title),
       },
     });
-    return { run: run as TestRunSummary, skipped: skipped as TestRunCaseSkip[] };
+    return { run, skipped };
   });
 
 // ── 回归徽标状态（Bug 详情挂载时查询）──
@@ -106,7 +107,7 @@ export const getBugRegressionStatusFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const projectId = await assertBugProjectMember(data.bugId, userId);
 
@@ -129,6 +130,10 @@ export const getBugRegressionStatusFn = createServerFn({ method: "GET" })
     });
     if (!latest) return { regression: null as BugRegressionStatus };
 
+    // completedAt=null 的 completed Run 属脏数据（终态必有完成时间），同归
+    // 「无有效绿色裁决」而非产出 completedAt:null 违反类型契约（审计 🟡）
+    if (!latest.completedAt) return { regression: null as BugRegressionStatus };
+
     // summary 是 Json 列：JS 侧收敛判定（total>0 防 0/0 脏数据假绿）
     const summary = latest.summary as { total?: number; passed?: number } | null;
     const allPassed =
@@ -142,7 +147,7 @@ export const getBugRegressionStatusFn = createServerFn({ method: "GET" })
       regression: {
         runId: latest.id,
         name: latest.name,
-        completedAt: latest.completedAt ? latest.completedAt.toISOString() : null,
-      } as BugRegressionStatus,
+        completedAt: latest.completedAt.toISOString(),
+      } satisfies BugRegressionStatus,
     };
   });

package/src/server/serverFns/testcase/run-cases.ts

@@ -43,18 +43,8 @@ import { fireTestRunWebhook } from "@/server/testcase/run-webhook";
 import { USER_BRIEF_SELECT, castUserBrief } from "@/server/story/types";
 import { RUN_STEP_RESULT_STATUS_VALUES } from "./constants";
 import type { RunCaseStepResult, RunCaseExecutionDetail } from "./types";
+import { assertRunCaseProjectMember, assertTestProjectMembership as assertProjectMembership } from "@/server/testcase/permissions";
 
-/** 项目有效成员校验（口径同 runs.ts：suspended 视同无权限；文件内私有副本——serverFn 文件间禁止互相 import） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的测试模块");
-  }
-}
 
 // ── 回报共享守卫（文件内私有）──
 
@@ -136,7 +126,7 @@ export const reportStepFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const { row } = await loadReportContext(data.runCaseId, userId);
     if (!snapshotOrders(row.caseSnapshot).has(data.order)) {
@@ -185,7 +175,7 @@ export const reportResultFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const { row, run } = await loadReportContext(data.runCaseId, userId);
     const now = new Date();
@@ -257,7 +247,7 @@ export const addEvidenceFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const { row } = await loadReportContext(data.runCaseId, userId);
     if (!snapshotOrders(row.caseSnapshot).has(data.order)) {
@@ -325,7 +315,8 @@ export const getRunCaseFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma();
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    await assertRunCaseProjectMember(data.id, session.user.id);
 
     const row = await prisma.testRunCase.findUnique({
       where: { id: data.id },