@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/testcase/runs.ts

@@ -34,10 +34,10 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import type { Prisma } from "@allbluecn/database";
-import type { AvatarConfig } from "@allbluecn/kernel";
 import { requireAuth } from "@/server/auth-helpers";
 import { resolveStoryScopeProjectId } from "@/server/builtin-project";
 import { buildCaseSnapshot } from "@/server/testcase/snapshot";
+import { USER_BRIEF_SELECT, castUserBrief } from "@/server/story/types";
 import {
   RUN_EXECUTOR_TYPE_VALUES,
   TEST_RUN_STATUS_VALUES,
@@ -45,38 +45,11 @@ import {
   type TestCaseType,
 } from "./constants";
 import type { TestCaseSteps, TestRunCaseSkip, TestRunDetail, TestRunSummary } from "./types";
+import { assertTestRunProjectMember, assertTestProjectMembership as assertProjectMembership } from "@/server/testcase/permissions";
+import { assertFetchableUrl, isDesktopRuntime } from "@/server/fetch-guard";
 
-/** 项目有效成员校验（口径同 plans.ts：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的测试模块");
-  }
-}
 
-// ── DTO cast（user brief select 与日期 cast 文件内私有，不外导）──
-
-const USER_BRIEF_SELECT = {
-  id: true,
-  username: true,
-  email: true,
-  avatarConfig: true,
-  bgShape: true,
-  bgColor: true,
-} as const;
-
-type UserBriefRow = Prisma.UserGetPayload<{ select: typeof USER_BRIEF_SELECT }>;
-
-function castUserBrief(row: UserBriefRow) {
-  return {
-    ...row,
-    avatarConfig: (row.avatarConfig as AvatarConfig | null) ?? null,
-  };
-}
+// ── DTO cast（user brief select 复用 story 域 types 单一事实源；其余文件内私有，不外导）──
 
 /** 快照源行：id/version/state + 快照五字段（buildCaseSnapshot 只吃五字段，不搬大元数据）
  * + automation（automation_code 模式纳入过滤用，任务 31；不入快照） */
@@ -233,7 +206,15 @@ export const createRunFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
+
+    // 审计 A3x-2 跨批收口：targetEnv 为 http(s) 时直用为 e2e 浏览器导航目标，
+    // 服务端浏览器访问用户可控 URL 须经 fetch-guard（私网放行仅 desktop / 显式 env，同 browser-policy）
+    if (data.targetEnv && /^https?:\/\//i.test(data.targetEnv)) {
+      assertFetchableUrl(data.targetEnv, {
+        allowPrivate: isDesktopRuntime() || process.env.AI_BROWSER_ALLOW_LOOPBACK === "true",
+      });
+    }
 
     // 用例集解析：planId 路径从 TestPlanCase 圈选集取；caseIds 路径按 scope 项目直取
     const skipped: TestRunCaseSkip[] = [];
@@ -401,7 +382,7 @@ export const abortRunFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const existing = await prisma.testRun.findUnique({
       where: { id: data.id },
@@ -438,7 +419,8 @@ export const getRunFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma();
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    await assertTestRunProjectMember(data.id, session.user.id);
     const row = await prisma.testRun.findUnique({
       where: { id: data.id },
       select: RUN_DETAIL_SELECT,
@@ -465,7 +447,7 @@ export const listRunsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // scope 解析：未传/无效/非成员 → 静默回退独立项目，防越权查询（同 listPlansFn）
     const projectId = await resolveStoryScopeProjectId(data.projectId, userId);

package/src/server/serverFns/testcase/stats.ts

@@ -42,25 +42,14 @@ import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { resolveStoryScopeProjectId } from "@/server/builtin-project";
-import { FAILURE_CATEGORY_VALUES } from "@/server/serverFns/testcase/constants";
-import type { RunCaseStatus } from "./constants";
+// 同目录模块统一相对路径单条 import（审计 🟢：拆成绝对自引 + 相对两条易漂移）
+import { FAILURE_CATEGORY_VALUES, type RunCaseStatus } from "./constants";
 import type {
   ProjectTestStats,
   RunFailureItem,
   RunFailureTriage,
 } from "./types";
-
-/** 项目有效成员校验（口径同 runs.ts/plans.ts：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的测试模块");
-  }
-}
+import { assertTestProjectMembership as assertProjectMembership } from "@/server/testcase/permissions";
 
 const storyIdSchema = z.object({ storyId: z.string().min(1) });
 
@@ -78,7 +67,7 @@ export const getStoryStalenessFn = createServerFn({ method: "GET" })
       select: { id: true, projectId: true, updatedAt: true },
     });
     if (!story) throw new Error("需求不存在");
-    await assertProjectMembership(story.projectId, session.user!.id!);
+    await assertProjectMembership(story.projectId, session.user.id);
 
     // 窄口径：需求「内容」（描述/标题）最后编辑时间 vs 最新关联用例创建时间。
     // 从 storyActivity 的 content_edited 时间锚推导（web 直写与 collab exporter
@@ -122,7 +111,7 @@ export const listGenerationStatsFn = createServerFn({ method: "GET" })
       select: { id: true, projectId: true },
     });
     if (!story) throw new Error("需求不存在");
-    await assertProjectMembership(story.projectId, session.user!.id!);
+    await assertProjectMembership(story.projectId, session.user.id);
 
     const rows = await prisma.testGenerationRun.findMany({
       where: { storyId: data.storyId },
@@ -166,7 +155,7 @@ export const getProjectTestStatsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const projectId = await resolveStoryScopeProjectId(data.projectId, session.user!.id!);
+    const projectId = await resolveStoryScopeProjectId(data.projectId, session.user.id);
 
     const since = new Date(Date.now() - TREND_DAYS * 24 * 60 * 60 * 1000);
     const [trendRows, genAgg, automationRows, flakyRows] = await Promise.all([
@@ -270,7 +259,7 @@ export const listRunFailuresFn = createServerFn({ method: "GET" })
       select: { id: true, projectId: true },
     });
     if (!run) throw new Error("执行批次不存在");
-    await assertProjectMembership(run.projectId, session.user!.id!);
+    await assertProjectMembership(run.projectId, session.user.id);
 
     const rows = await prisma.testRunCase.findMany({
       where: { runId: run.id, status: { in: ["failed", "blocked"] } },

package/src/server/serverFns/testcase/testcase-activities.ts

@@ -25,6 +25,7 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
+import { assertTestCaseProjectMember } from "@/server/testcase/permissions";
 import { USER_BRIEF_SELECT, castUserBrief } from "@/server/story/types";
 import type { TestCaseActivityItem } from "./types";
 
@@ -38,7 +39,8 @@ export const listTestCaseActivitiesFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma();
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    await assertTestCaseProjectMember(data.caseId, session.user.id);
 
     const rows = await prisma.projectActivity.findMany({
       where: { targetType: "testcase", targetId: data.caseId },

package/src/server/serverFns/testcase/testcase-board.ts

@@ -27,10 +27,10 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import type { Prisma } from "@allbluecn/database";
-import type { AvatarConfig } from "@allbluecn/kernel";
 import { requireAuth } from "@/server/auth-helpers";
 import { resolveStoryScopeProjectIds } from "@/server/builtin-project";
 import { buildListWhere } from "@/server/testcase/list-query";
+import { USER_BRIEF_SELECT, castUserBrief } from "@/server/story/types";
 import {
   TESTCASE_ORDER_DIRECTIONS,
   TESTCASE_ORDER_FIELD_MAP,
@@ -60,16 +60,8 @@ function buildColumnFilter(groupBy: BoardGroupKey, key: string): Prisma.TestCase
 }
 
 // ── 列条目 DTO：与列表 TestCaseSummary 同形 + boardOrder（列内当前权重，
-// 任务 26 拖拽排序决策可读；select 拷贝自 testcase-crud 的 LIST_SELECT 加此列）──
-
-const USER_BRIEF_SELECT = {
-  id: true,
-  username: true,
-  email: true,
-  avatarConfig: true,
-  bgShape: true,
-  bgColor: true,
-} as const;
+// 任务 26 拖拽排序决策可读；select 拷贝自 testcase-crud 的 LIST_SELECT 加此列；
+// user brief select 复用 story 域 types 单一事实源）──
 
 const TEST_CASE_BOARD_SELECT = {
   id: true,
@@ -111,16 +103,8 @@ function castBoardCase(row: TestCaseBoardRow): TestCaseBoardItem {
     priority: row.priority as TestCasePriority,
     state: row.state as TestCaseState,
     automation: row.automation as TestCaseAutomation,
-    assignee: row.assignee
-      ? {
-          ...row.assignee,
-          avatarConfig: (row.assignee.avatarConfig as AvatarConfig | null) ?? null,
-        }
-      : null,
-    createdBy: {
-      ...row.createdBy,
-      avatarConfig: (row.createdBy.avatarConfig as AvatarConfig | null) ?? null,
-    },
+    assignee: row.assignee ? castUserBrief(row.assignee) : null,
+    createdBy: castUserBrief(row.createdBy),
     createdAt: row.createdAt.toISOString(),
     updatedAt: row.updatedAt.toISOString(),
   };
@@ -155,7 +139,7 @@ export const listTestCaseBoardColumnsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const projectIds = await resolveStoryScopeProjectIds(data.projectId, userId);
     const base = buildListWhere({

package/src/server/serverFns/testcase/testcase-crud.ts

@@ -28,11 +28,11 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import type { Prisma } from "@allbluecn/database";
-import type { AvatarConfig } from "@allbluecn/kernel";
 import { requireAuth } from "@/server/auth-helpers";
 import { resolveStoryScopeProjectIds } from "@/server/builtin-project";
 import { buildListWhere } from "@/server/testcase/list-query";
-import { isUserInTeam } from "@/server/team-access";
+import { validateAssignee } from "@/server/lib/validate-assignee";
+import { USER_BRIEF_SELECT, castUserBrief } from "@/server/story/types";
 import {
   TESTCASE_ORDER_DIRECTIONS,
   TESTCASE_ORDER_FIELD_MAP,
@@ -55,18 +55,8 @@ import { buildRoomName } from "@allbluecn/collab-core/rooms";
 import { normalizeCollabSteps } from "@allbluecn/collab-core/steps";
 import { withCollabGuard } from "@/server/collab/write-guard";
 import { touchCollabSnapshot } from "@/server/collab/touch-snapshot";
+import { assertTestCaseProjectMember, assertTestProjectMembership as assertProjectMembership } from "@/server/testcase/permissions";
 
-/** 项目有效成员校验（口径同 testcase-folders / deleteBugFn：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的测试模块");
-  }
-}
 
 /** folderId 归属校验（拒绝路径零写：事务前完成） */
 async function assertFolderInProject(projectId: string, folderId: string | null | undefined) {
@@ -91,28 +81,9 @@ async function assertStoryInProject(projectId: string, storyId: string | null |
 }
 
 /** 负责人须为团队成员（口径同 validateBugAssignee） */
-async function validateAssignee(projectId: string, assigneeId: string | null | undefined) {
-  if (!assigneeId) return;
-  const prisma = await getPrisma();
-  const project = await prisma.project.findUnique({
-    where: { id: projectId },
-    select: { ownerId: true },
-  });
-  if (!project) throw new Error("项目不存在");
-  const ok = await isUserInTeam(project.ownerId, assigneeId);
-  if (!ok) throw new Error("负责人必须是团队成员");
-}
 
-// ── 列表 DTO（TestCaseSummary）：user brief select 与日期 cast 文件内私有，不外导 ──
-
-const USER_BRIEF_SELECT = {
-  id: true,
-  username: true,
-  email: true,
-  avatarConfig: true,
-  bgShape: true,
-  bgColor: true,
-} as const;
+// ── 列表 DTO（TestCaseSummary）：user brief select 复用 story 域 types 单一事实源，
+//    日期 cast 文件内私有，不外导 ──
 
 const TEST_CASE_LIST_SELECT = {
   id: true,
@@ -149,16 +120,8 @@ function castTestCase(row: TestCaseRow): TestCaseSummary {
     priority: row.priority as TestCasePriority,
     state: row.state as TestCaseState,
     automation: row.automation as TestCaseAutomation,
-    assignee: row.assignee
-      ? {
-          ...row.assignee,
-          avatarConfig: (row.assignee.avatarConfig as AvatarConfig | null) ?? null,
-        }
-      : null,
-    createdBy: {
-      ...row.createdBy,
-      avatarConfig: (row.createdBy.avatarConfig as AvatarConfig | null) ?? null,
-    },
+    assignee: row.assignee ? castUserBrief(row.assignee) : null,
+    createdBy: castUserBrief(row.createdBy),
     createdAt: row.createdAt.toISOString(),
     updatedAt: row.updatedAt.toISOString(),
   };
@@ -200,7 +163,7 @@ export const listTestCasesFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // scope 解析（同 story/story-groups 与 bug 域）：未传 → 成员关系全部项目聚合；
     // 单项目经鉴权（无效/非成员 → 静默回退独立项目），防越权查询
@@ -251,7 +214,7 @@ export const createTestCaseFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await assertProjectMembership(data.projectId, userId);
     await assertFolderInProject(data.projectId, data.folderId);
@@ -366,7 +329,7 @@ export const updateTestCaseFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // ── Yjs 多人协作 §5.3 写入门卫（任务 22；T21 教训：提至 $transaction
     // 之前——门卫转发含网络 I/O（TTL 内重试最坏 ≈4s），事务内等待会击穿
@@ -408,105 +371,105 @@ export const updateTestCaseFn = createServerFn({ method: "POST" })
     // 读 + expectedVersion 校验 + diff 全部在事务内（fast-follow：check-then-act 的
     // 版本塌缩竞态会波及 automation 产物的 stale 锚；事务内重读对账，task 20 adopt 先例）
     const updated = await prisma.$transaction(async (tx) => {
-    const existing = await tx.testCase.findUnique({
-      where: { id: data.id },
-      select: TEST_CASE_LIST_SELECT,
-    });
-    if (!existing) throw new Error("用例不存在");
-    await assertProjectMembership(existing.projectId, userId);
+        const existing = await tx.testCase.findUnique({
+          where: { id: data.id },
+          select: TEST_CASE_LIST_SELECT,
+        });
+        if (!existing) throw new Error("用例不存在");
+        await assertProjectMembership(existing.projectId, userId);
 
-    if (data.expectedVersion !== undefined && data.expectedVersion !== existing.version) {
-      throw new Error("用例已被他人修改（版本冲突），请刷新后重试");
-    }
+        if (data.expectedVersion !== undefined && data.expectedVersion !== existing.version) {
+          throw new Error("用例已被他人修改（版本冲突），请刷新后重试");
+        }
 
-    await assertFolderInProject(existing.projectId, data.folderId);
-    await assertStoryInProject(existing.projectId, data.storyId);
-    await validateAssignee(existing.projectId, data.assigneeId);
-
-    const updates: Prisma.TestCaseUpdateInput = {};
-    // 内容面（caseSnapshot 锁定的五个字段）实际变更才 version+1。
-    // Y 属主面（6 字段 + steps）：forwarded 时从直写数据剥离——写入由 collab
-    // 接管（web 侧再写即双写互吞；version+1/活动由 collab 落库侧
-    // writeCaseColumns 产出，web 再写即双 bump/重复流水）。forwarded 且剥离后
-    // 无剩余写入 → 下方既有的「无变化早退」自然生效（不 update 不留痕）。
-    let contentChanged = false;
-    if (!forwarded) {
-    if (data.title !== undefined && data.title !== existing.title) {
-      updates.title = data.title;
-      contentChanged = true;
-    }
-    if (data.precondition !== undefined && data.precondition !== existing.precondition) {
-      updates.precondition = data.precondition;
-      contentChanged = true;
-    }
-    if (data.steps !== undefined && JSON.stringify(data.steps) !== JSON.stringify(existing.steps)) {
-      updates.steps = data.steps as unknown as Prisma.InputJsonValue;
-      contentChanged = true;
-    }
-    if (data.type !== undefined && data.type !== existing.type) {
-      updates.type = data.type;
-      contentChanged = true;
-    }
-    if (data.priority !== undefined && data.priority !== existing.priority) {
-      updates.priority = data.priority;
-      contentChanged = true;
-    }
-    // 元数据面：不 bump version
-    if (data.state !== undefined && data.state !== existing.state) updates.state = data.state;
-    if (data.assigneeId !== undefined) {
-      const next = data.assigneeId;
-      if (next !== (existing.assignee?.id ?? null)) {
-        updates.assignee = next ? { connect: { id: next } } : { disconnect: true };
-      }
-    }
-    } // ── end if (!forwarded)：Y 属主面剥离完毕 ──
-    // 非 Y 字段照旧直写（无论门卫裁决——Y 从不拥有它们，无互吞面）
-    if (data.automation !== undefined && data.automation !== existing.automation) {
-      updates.automation = data.automation;
-    }
-    if (data.folderId !== undefined && data.folderId !== existing.folderId) {
-      updates.folder = data.folderId ? { connect: { id: data.folderId } } : { disconnect: true };
-    }
-    if (data.storyId !== undefined && data.storyId !== existing.storyId) {
-      updates.story = data.storyId ? { connect: { id: data.storyId } } : { disconnect: true };
-    }
-    if (contentChanged) updates.version = { increment: 1 };
+        await assertFolderInProject(existing.projectId, data.folderId);
+        await assertStoryInProject(existing.projectId, data.storyId);
+        await validateAssignee(existing.projectId, data.assigneeId);
+
+        const updates: Prisma.TestCaseUpdateInput = {};
+        // 内容面（caseSnapshot 锁定的五个字段）实际变更才 version+1。
+        // Y 属主面（6 字段 + steps）：forwarded 时从直写数据剥离——写入由 collab
+        // 接管（web 侧再写即双写互吞；version+1/活动由 collab 落库侧
+        // writeCaseColumns 产出，web 再写即双 bump/重复流水）。forwarded 且剥离后
+        // 无剩余写入 → 下方既有的「无变化早退」自然生效（不 update 不留痕）。
+        let contentChanged = false;
+        if (!forwarded) {
+            if (data.title !== undefined && data.title !== existing.title) {
+              updates.title = data.title;
+              contentChanged = true;
+            }
+            if (data.precondition !== undefined && data.precondition !== existing.precondition) {
+              updates.precondition = data.precondition;
+              contentChanged = true;
+            }
+            if (data.steps !== undefined && JSON.stringify(data.steps) !== JSON.stringify(existing.steps)) {
+              updates.steps = data.steps as unknown as Prisma.InputJsonValue;
+              contentChanged = true;
+            }
+            if (data.type !== undefined && data.type !== existing.type) {
+              updates.type = data.type;
+              contentChanged = true;
+            }
+            if (data.priority !== undefined && data.priority !== existing.priority) {
+              updates.priority = data.priority;
+              contentChanged = true;
+            }
+            // 元数据面：不 bump version
+            if (data.state !== undefined && data.state !== existing.state) updates.state = data.state;
+            if (data.assigneeId !== undefined) {
+              const next = data.assigneeId;
+              if (next !== (existing.assignee?.id ?? null)) {
+                updates.assignee = next ? { connect: { id: next } } : { disconnect: true };
+              }
+            }
+        } // ── end if (!forwarded)：Y 属主面剥离完毕 ──
+        // 非 Y 字段照旧直写（无论门卫裁决——Y 从不拥有它们，无互吞面）
+        if (data.automation !== undefined && data.automation !== existing.automation) {
+          updates.automation = data.automation;
+        }
+        if (data.folderId !== undefined && data.folderId !== existing.folderId) {
+          updates.folder = data.folderId ? { connect: { id: data.folderId } } : { disconnect: true };
+        }
+        if (data.storyId !== undefined && data.storyId !== existing.storyId) {
+          updates.story = data.storyId ? { connect: { id: data.storyId } } : { disconnect: true };
+        }
+        if (contentChanged) updates.version = { increment: 1 };
 
-    // 无变化早退返回原始行，DTO 转换统一由事务外的 castTestCase(updated) 一次完成
-    if (Object.keys(updates).length === 0) return existing;
+        // 无变化早退返回原始行，DTO 转换统一由事务外的 castTestCase(updated) 一次完成
+        if (Object.keys(updates).length === 0) return existing;
 
-    // R11 touch 不变式判定：生效直写是否含 Y 属主面。forwarded 时 Y 字段已
-    // 剥离（updates 只剩 automation/folder/story 等非 Y 面）；pass-through/
-    // degraded 直写 Y 字段 → 旁路语义，业务列必须反超快照让重种子化兜底，
-    // 刻意不 touch。
-    const writesYFace = Object.keys(updates).some((key) => CASE_Y_UPDATE_KEYS.has(key));
+        // R11 touch 不变式判定：生效直写是否含 Y 属主面。forwarded 时 Y 字段已
+        // 剥离（updates 只剩 automation/folder/story 等非 Y 面）；pass-through/
+        // degraded 直写 Y 字段 → 旁路语义，业务列必须反超快照让重种子化兜底，
+        // 刻意不 touch。
+        const writesYFace = Object.keys(updates).some((key) => CASE_Y_UPDATE_KEYS.has(key));
 
-    // update + 活动留痕同事务（规格 §5.2：create/update 均为关键事件；字段惯例照
-    // createTestCaseFn / testcase-folders：action/targetType/targetId 五字段无 metadata）
-    const row = await tx.testCase.update({
-      where: { id: data.id },
-      data: updates,
-      select: TEST_CASE_LIST_SELECT,
-    });
-    // R11 touch：生效直写为纯非 Y patch（automation/folderId/storyId）时
-    // 同步快照 updatedAt = 回读行 updatedAt（无快照计 0 天然跳过）
-    if (!writesYFace) {
-      await touchCollabSnapshot(
-        tx,
-        buildRoomName({ kind: "entity-case", caseId: data.id }),
-        row.updatedAt,
-      );
-    }
-    await tx.projectActivity.create({
-      data: {
-        projectId: existing.projectId,
-        userId,
-        action: "updated",
-        targetType: "testcase",
-        targetId: existing.id,
-      },
-    });
-    return row;
+        // update + 活动留痕同事务（规格 §5.2：create/update 均为关键事件；字段惯例照
+        // createTestCaseFn / testcase-folders：action/targetType/targetId 五字段无 metadata）
+        const row = await tx.testCase.update({
+          where: { id: data.id },
+          data: updates,
+          select: TEST_CASE_LIST_SELECT,
+        });
+        // R11 touch：生效直写为纯非 Y patch（automation/folderId/storyId）时
+        // 同步快照 updatedAt = 回读行 updatedAt（无快照计 0 天然跳过）
+        if (!writesYFace) {
+          await touchCollabSnapshot(
+            tx,
+            buildRoomName({ kind: "entity-case", caseId: data.id }),
+            row.updatedAt,
+          );
+        }
+        await tx.projectActivity.create({
+          data: {
+            projectId: existing.projectId,
+            userId,
+            action: "updated",
+            targetType: "testcase",
+            targetId: existing.id,
+          },
+        });
+        return row;
     });
     return castTestCase(updated);
   });
@@ -535,7 +498,8 @@ export const getTestCaseFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma();
     const request = getRequest();
-    await requireAuth(request);
+    const session = await requireAuth(request);
+    await assertTestCaseProjectMember(data.id, session.user.id);
     const row = await prisma.testCase.findUnique({
       where: { id: data.id },
       select: TEST_CASE_DETAIL_SELECT,
@@ -552,7 +516,7 @@ export const archiveTestCaseFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const existing = await prisma.testCase.findUnique({
       where: { id: data.id },
@@ -586,7 +550,7 @@ export const deleteTestCaseFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const existing = await prisma.testCase.findUnique({
       where: { id: data.id },
@@ -595,17 +559,17 @@ export const deleteTestCaseFn = createServerFn({ method: "POST" })
     if (!existing) throw new Error("用例不存在");
     await assertProjectMembership(existing.projectId, userId);
 
-    // 有执行记录引用时拒绝删除转提示归档（DB 层 Cascade 会连带抹掉历史执行，防误删）
-    const runCaseCount = await prisma.testRunCase.count({ where: { caseId: existing.id } });
-    if (runCaseCount > 0) {
-      throw new Error(`该用例已被 ${runCaseCount} 条执行记录引用，无法删除，请改用归档`);
-    }
-
     // 删除实体 + 协同快照同事务清理（Yjs 多人协作 §5.2 删除路径，story/
     // knowledge/bug 删除同构）：实体删后快照行必删，防 collab 服务后续装载
     // 幽灵 room；用 deleteMany 而非 delete——room 未协同打开过时无行，delete
     // 会 P2025 竞态炸。room 命名与 collab-core 注册表一致（entity:case:<id>）。
     await prisma.$transaction(async (tx) => {
+      // 引用计数守卫入事务（审计 🟡 TOCTOU：count 与 delete 间隙新增的 RunCase
+      // 引用此前会绕过守卫被级联抹掉；事务内重查对账，同 update 惯例）
+      const runCaseCount = await tx.testRunCase.count({ where: { caseId: existing.id } });
+      if (runCaseCount > 0) {
+        throw new Error(`该用例已被 ${runCaseCount} 条执行记录引用，无法删除，请改用归档`);
+      }
       await tx.testCase.delete({ where: { id: existing.id } });
       await tx.collabDocument.deleteMany({
         where: { roomName: buildRoomName({ kind: "entity-case", caseId: existing.id }) },

package/src/server/serverFns/testcase/testcase-display-options.ts

@@ -113,7 +113,7 @@ export const getTestCaseDisplayOptionsFn = createServerFn({ method: "GET" }).han
   const prisma = await getPrisma();
   const request = getRequest();
   const session = await requireAuth(request);
-  const userId = session.user!.id!;
+  const userId = session.user.id;
 
   const row = await prisma.testCaseFilterView.findFirst({
     where: { userId, name: TESTCASE_DISPLAY_OPTIONS_VIEW_NAME },
@@ -132,7 +132,7 @@ export const updateTestCaseDisplayOptionsFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // 服务端强制校验：pageSize > 200（500/1000）为 Pro 专属，前端锁定只是 UX
     const options: TestCaseDisplayOptions = {

package/src/server/serverFns/testcase/testcase-export.ts

@@ -75,7 +75,7 @@ export const exportTestCasesFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const projectIds = await resolveStoryScopeProjectIds(data.projectId, userId);