@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/testcase/testcase-filter-views.ts

@@ -129,7 +129,7 @@ export const listFilterViewsFn = createServerFn({ method: "GET" }).handler(async
   const prisma = await getPrisma();
   const request = getRequest();
   const session = await requireAuth(request);
-  const userId = session.user!.id!;
+  const userId = session.user.id;
   const rows = await prisma.testCaseFilterView.findMany({
     where: { userId, ...NOT_RESERVED },
     orderBy: { sortOrder: "asc" },
@@ -158,7 +158,7 @@ export const createFilterViewFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     const row = await prisma.testCaseFilterView.create({
       data: {
         userId,
@@ -193,7 +193,7 @@ export const updateFilterViewFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     const { id, ...patch } = data;
     const updates: Record<string, unknown> = {};
     if (patch.name !== undefined) updates.name = patch.name;
@@ -219,7 +219,7 @@ export const deleteFilterViewFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await prisma.testCaseFilterView.delete({
       // userId + 非保留名限定：他人视图与显示选项保留行均删不到（照 bug-views.ts）
       where: { id: data.id, userId, ...NOT_RESERVED },

package/src/server/serverFns/testcase/testcase-folders.ts

@@ -25,18 +25,7 @@ import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { ensureBuiltinIndependentProject, resolveStoryScopeProjectId } from "@/server/builtin-project";
-
-/** 项目有效成员校验（R 口径同 deleteBugFn：suspended 视同无权限） */
-async function assertProjectMembership(projectId: string, userId: string) {
-  const prisma = await getPrisma();
-  const membership = await prisma.projectMember.findUnique({
-    where: { projectId_userId: { projectId, userId } },
-    select: { status: true },
-  });
-  if (!membership || membership.status === "suspended") {
-    throw new Error("无权限操作该项目的测试模块");
-  }
-}
+import { assertTestProjectMembership as assertProjectMembership } from "@/server/testcase/permissions";
 
 // ── 列表：按 projectId 树序返回（parentId + position 升序的扁平列表，客户端组树）──
 
@@ -48,7 +37,7 @@ export const listFoldersFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const projectId = await resolveStoryScopeProjectId(data.projectId, userId);
 
@@ -74,7 +63,7 @@ export const createFolderFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     let projectId = data.projectId;
     if (projectId) {
@@ -137,7 +126,7 @@ export const renameFolderFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await getFolderWithMembership(data.id, userId);
 
@@ -155,17 +144,18 @@ export const deleteFolderFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const folder = await getFolderWithMembership(data.id, userId);
 
-    // 有子模块或用例时拒绝（model 层 Cascade 只在删父模块时生效，此处防误删整棵子树）
-    const childCount = await prisma.testCaseFolder.count({ where: { parentId: folder.id } });
-    if (childCount > 0) throw new Error("该模块存在子模块，请先删除或移出子模块");
-    const caseCount = await prisma.testCase.count({ where: { folderId: folder.id } });
-    if (caseCount > 0) throw new Error("该模块下存在用例，请先移出用例后再删除");
-
     await prisma.$transaction(async (tx) => {
+      // 子模块/用例计数守卫入事务（审计 🟡 TOCTOU：count 与 delete 间隙写入的
+      // 子模块/用例此前会被级联删除；事务内重查对账）
+      const childCount = await tx.testCaseFolder.count({ where: { parentId: folder.id } });
+      if (childCount > 0) throw new Error("该模块存在子模块，请先删除或移出子模块");
+      const caseCount = await tx.testCase.count({ where: { folderId: folder.id } });
+      if (caseCount > 0) throw new Error("该模块下存在用例，请先移出用例后再删除");
+
       await tx.testCaseFolder.delete({ where: { id: folder.id } });
       await tx.projectActivity.create({
         data: {
@@ -192,7 +182,7 @@ export const reorderFolderFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     const folder = await getFolderWithMembership(data.id, userId);
 

package/src/server/serverFns/testcase/testcase-groups.ts

@@ -97,7 +97,7 @@ export const listGroupsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma();
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     // scope 解析与列表一致（同 story/story-groups 与 bug 域）：未传 → 成员关系
     // 全部项目聚合；单项目经鉴权（无效/非成员 → 静默回退独立项目），防越权查询

package/src/server/serverFns/testcase/testcase-reorder.ts

@@ -48,7 +48,7 @@ export const reorderTestCasesFn = createServerFn({ method: "POST" })
     // 可见性过滤进 where（SEC-03：防跨项目改他人用例排序）；updateMany 对
     // 越权/不存在 id 静默跳过，不中断整批合法排序
     const memberships = await prisma.projectMember.findMany({
-      where: { userId: session.user!.id!, status: { not: "suspended" } },
+      where: { userId: session.user.id, status: { not: "suspended" } },
       select: { projectId: true },
     });
     const visibleProjectIds = memberships.map((m) => m.projectId);

package/src/server/serverFns/translation.ts

@@ -19,6 +19,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
+import { checkAiRateLimit } from '@/server/lib/rate-limit'
 import { hasAiKey } from "@/server/ai-gateway/adapter"
 import { runChatAsAgent } from "@/server/ai-gateway/runs/agent-runtime"
 
@@ -33,7 +34,9 @@ export const translateFn = createServerFn({ method: 'POST' })
   .handler(async ({ data }) => {
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
+    const userId = session.user.id
+    // AI 昂贵调用独立限流（审计 🟠：对照 startGenerationFn 同款；先于 hasAiKey 消耗配额）
+    await checkAiRateLimit(userId, "translation")
     if (!(await hasAiKey(userId))) throw new Error('AI 未配置')
 
     const translated = await runChatAsAgent(

package/src/server/serverFns/user/avatar.ts

@@ -34,7 +34,7 @@ export const updateAvatarFn = createServerFn({ method: 'POST' })
     const request = getRequest()
     const session = await requireAuth(request)
     const user = await prisma.user.update({
-      where: { id: session.user!.id! },
+      where: { id: session.user.id },
       data: { ...data, avatarConfig: data.avatarConfig as object },
     })
     return { avatarConfig: user.avatarConfig, bgShape: user.bgShape, bgColor: user.bgColor }

package/src/server/serverFns/user/settings.ts

@@ -32,7 +32,7 @@ export const updateUserTimezoneFn = createServerFn({ method: 'POST' })
     const request = getRequest()
     const session = await requireAuth(request)
     await prisma.user.update({
-      where: { id: session.user!.id! },
+      where: { id: session.user.id },
       data: { timezone: data.timezone },
     })
     return { success: true }

package/src/server/serverFns/user/update-locale.ts

@@ -12,7 +12,7 @@ export const updateLocaleFn = createServerFn({ method: 'POST' })
     const request = getRequest()
     const session = await requireAuth(request)
     await prisma.user.update({
-      where: { id: session.user!.id! },
+      where: { id: session.user.id },
       data: { locale: data.locale },
     })
     return { success: true }

package/src/server/serverFns/workspace-kb.ts

@@ -23,7 +23,7 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { requireAuth } from "@/server/auth-helpers";
 import { GENERAL_GROUP_TABLES, GENERAL_GROUPS, type GeneralGroup } from "@/server/knowledge/kb-general";
-import type { QuickDocRow, WorkspaceKbCardData, QuickDocItem } from "./workspace-kb-utils";
+import type { QuickDocRow, WorkspaceKbCardData } from "./workspace-kb-utils";
 import {
   searchGeneralGroupDocs,
   listUserTeamKbIds,
@@ -43,13 +43,45 @@ async function requireWorkspaceMember(workspaceId: string, userId: string) {
   if (ws.ownerId !== userId && ws.members.length === 0) throw new Error("仅工作空间成员可访问");
 }
 
+/**
+ * 通用组表动态访问的单点 cast 收口（审计 ⚪：替代调用点散落的 as unknown as 双 cast）。
+ * 仅暴露 findMany 最小面，行形状由调用方泛型声明。
+ */
+async function findGeneralGroupRows<R>(
+  group: Exclude<GeneralGroup, "summary">,
+  args: { where: Record<string, unknown>; select: Record<string, boolean> },
+): Promise<R[]> {
+  const prisma = await getPrisma();
+  const model = prisma[GENERAL_GROUP_TABLES[group]] as unknown as {
+    findMany: (a: typeof args) => Promise<R[]>;
+  };
+  return model.findMany(args);
+}
+
+/**
+ * 通用组条目的用户可访问范围（审计 🟠：对齐 searchGeneralGroupDocs 候选侧归属口径
+ * ——本人创建 ∪ 本人收藏），防把他人条目挂成快捷文档后标题跨用户回显。
+ */
+async function generalGroupVisibleFilter(
+  group: Exclude<GeneralGroup, "summary">,
+  userId: string,
+): Promise<Record<string, unknown>> {
+  const prisma = await getPrisma();
+  const favoriteIds = await prisma.articleFavorite
+    .findMany({ where: { entityType: group, userId }, select: { entityId: true } })
+    .then((r) => r.map((f) => f.entityId));
+  return {
+    OR: [{ userId }, ...(favoriteIds.length > 0 ? [{ id: { in: favoriteIds } }] : [])],
+  };
+}
+
 export const getWorkspaceKbCardFn = createServerFn({ method: "GET" })
   .validator(z.object({ workspaceId: z.string() }))
   .handler(async ({ data }): Promise<WorkspaceKbCardData> => {
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireWorkspaceMember(data.workspaceId, userId);
 
     const [linkRows, quickRows] = await Promise.all([
@@ -89,11 +121,15 @@ export const getWorkspaceKbCardFn = createServerFn({ method: "GET" })
       }
     }
     for (const [group, ids] of byGroup) {
-      const rows = await (
-        prisma[GENERAL_GROUP_TABLES[group]] as unknown as {
-          findMany: (args: Record<string, unknown>) => Promise<Array<{ id: string; title: string; faviconUrl?: string | null; url?: string | null }>>;
-        }
-      ).findMany({ where: { id: { in: ids } }, select: { id: true, title: true, faviconUrl: true, url: true } });
+      const rows = await findGeneralGroupRows<{
+        id: string;
+        title: string;
+        faviconUrl?: string | null;
+        url?: string | null;
+      }>(group, {
+        where: { id: { in: ids } },
+        select: { id: true, title: true, faviconUrl: true, url: true },
+      });
       const map = new Map(rows.map((r) => [r.id, r.title]));
       const faviconMap = new Map(rows.map((r) => [r.id, r.faviconUrl ?? null]));
       const urlMap = new Map(rows.map((r) => [r.id, (r.url as string | null) ?? null]));
@@ -138,7 +174,7 @@ export const listWorkspaceAvailableKbsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireWorkspaceMember(data.workspaceId, userId);
 
     const linked = await prisma.workspaceKnowledgeBase.findMany({
@@ -164,11 +200,23 @@ export const setWorkspaceKbsFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    await requireWorkspaceMember(data.workspaceId, session.user!.id!);
+    await requireWorkspaceMember(data.workspaceId, session.user.id);
 
+    // 校验与候选清单（listWorkspaceAvailableKbsFn）同口径（审计 🟡）：
+    // 本空间已关联 ∪ 本人 team 库——防凭 id 把任意他人 team 库挂入自己空间
+    const linked = await prisma.workspaceKnowledgeBase.findMany({
+      where: { workspaceId: data.workspaceId },
+      select: { kbId: true },
+    });
+    const linkedIds = linked.map((l) => l.kbId);
     if (data.kbIds.length > 0) {
       const valid = await prisma.knowledgeBase.findMany({
-        where: { id: { in: data.kbIds }, visibility: "team", isDeleted: false },
+        where: {
+          id: { in: data.kbIds },
+          visibility: "team",
+          isDeleted: false,
+          OR: [{ id: { in: linkedIds } }, { userId: session.user.id }],
+        },
         select: { id: true },
       });
       if (valid.length !== data.kbIds.length) {
@@ -202,7 +250,7 @@ export const searchQuickDocCandidatesFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireWorkspaceMember(data.workspaceId, userId);
 
     if (data.generalGroup) {
@@ -247,7 +295,7 @@ export const addQuickDocsFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireWorkspaceMember(data.workspaceId, userId);
 
     // DB-01：批量快捷文档原每项 2~3 次串行查询（存在性 findFirst + 查重 findFirst + create）。
@@ -271,19 +319,22 @@ export const addQuickDocsFn = createServerFn({ method: "POST" })
     }
 
     // 预取存在性：知识库文档一次 in 查询；通用组表按出现的分组各一次 in 查询
-    const docIds = [...new Set((data.items as QuickDocItem[]).map((i) => i.docId).filter((id): id is string => !!id))];
+    const docIds = [...new Set(data.items.map((i) => i.docId).filter((id): id is string => !!id))];
+    // 存在性校验限定可访问范围（审计 🟠）：对齐候选侧 listUserTeamKbIds 口径，
+    // 防把他人私有/团队库文档挂成快捷文档后标题与库名跨用户回显
+    const teamKbIds = docIds.length > 0 ? await listUserTeamKbIds(userId) : [];
     const existingDocIds = docIds.length
       ? new Set(
           (
             await prisma.knowledgeDocument.findMany({
-              where: { id: { in: docIds }, isDeleted: false },
+              where: { id: { in: docIds }, isDeleted: false, kb: { id: { in: teamKbIds } } },
               select: { id: true },
             })
           ).map((d) => d.id),
         )
       : new Set<string>();
     const externalIdsByGroup = new Map<Exclude<GeneralGroup, "summary">, string[]>();
-    for (const item of data.items as QuickDocItem[]) {
+    for (const item of data.items) {
       if (item.docId || !item.externalGroup || item.externalGroup === "summary") continue;
       const ids = externalIdsByGroup.get(item.externalGroup) ?? [];
       if (item.externalId) ids.push(item.externalId);
@@ -291,11 +342,14 @@ export const addQuickDocsFn = createServerFn({ method: "POST" })
     }
     const existingExternalIds = new Map<string, Set<string>>();
     for (const [group, ids] of externalIdsByGroup) {
-      const rows = await (
-        prisma[GENERAL_GROUP_TABLES[group]] as unknown as {
-          findMany: (args: Record<string, unknown>) => Promise<Array<{ id: string }>>;
-        }
-      ).findMany({ where: { id: { in: [...new Set(ids)] }, isDeleted: false }, select: { id: true } });
+      const rows = await findGeneralGroupRows<{ id: string }>(group, {
+        where: {
+          id: { in: [...new Set(ids)] },
+          isDeleted: false,
+          ...(await generalGroupVisibleFilter(group, userId)),
+        },
+        select: { id: true },
+      });
       existingExternalIds.set(group, new Set(rows.map((r) => r.id)));
     }
 
@@ -303,7 +357,7 @@ export const addQuickDocsFn = createServerFn({ method: "POST" })
     const failed: Array<{ key: string; reason: "outOfScope" | "duplicate" }> = [];
     const rowsToCreate: Array<Record<string, unknown>> = [];
 
-    for (const item of data.items as QuickDocItem[]) {
+    for (const item of data.items) {
       const key = quickDocItemKey(item);
       const targetCol = counts.indexOf(Math.min(...counts));
       const order = maxOrder[targetCol] + 1;
@@ -374,7 +428,7 @@ export const renameQuickDocFn = createServerFn({ method: "POST" })
       select: { workspaceId: true },
     });
     if (!row) throw new Error("快捷文档不存在");
-    await requireWorkspaceMember(row.workspaceId, session.user!.id!);
+    await requireWorkspaceMember(row.workspaceId, session.user.id);
     await prisma.workspaceQuickDoc.update({
       where: { id: data.quickDocId },
       data: {
@@ -396,7 +450,7 @@ export const removeQuickDocFn = createServerFn({ method: "POST" })
       select: { workspaceId: true },
     });
     if (!row) throw new Error("快捷文档不存在");
-    await requireWorkspaceMember(row.workspaceId, session.user!.id!);
+    await requireWorkspaceMember(row.workspaceId, session.user.id);
     await prisma.workspaceQuickDoc.delete({ where: { id: data.quickDocId } });
     return { ok: true };
   });
@@ -405,16 +459,19 @@ export const reorderQuickDocsFn = createServerFn({ method: "POST" })
   .validator(
     z.object({
       workspaceId: z.string(),
-      items: z.array(
-        z.object({ id: z.string(), columnIndex: z.number().int().min(0), sortOrder: z.number().int().min(0) }),
-      ),
+      // 上限 500 与 reorderTestCasesFn 同字段口径对齐（审计 🟡：防超大数组生成等量 update 事务）
+      items: z
+        .array(
+          z.object({ id: z.string(), columnIndex: z.number().int().min(0), sortOrder: z.number().int().min(0) }),
+        )
+        .max(500),
     }),
   )
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    await requireWorkspaceMember(data.workspaceId, session.user!.id!);
+    await requireWorkspaceMember(data.workspaceId, session.user.id);
     const ids = data.items.map((item) => item.id);
     const owned = await prisma.workspaceQuickDoc.findMany({
       where: { id: { in: ids }, workspaceId: data.workspaceId },

package/src/server/serverFns/workspace.ts

@@ -22,18 +22,9 @@ import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { migrateStoriesToIndependentProject } from "@/server/builtin-project";
 import { requireResource } from "@/server/resources";
+import { USER_BRIEF_SELECT } from "@/server/story/types";
 import { startOfMonth, endOfMonth, subMonths, eachDayOfInterval } from "date-fns";
 import { formatInTimeZone } from "date-fns-tz";
-import type { Prisma } from "@allbluecn/database";
-
-const USER_BRIEF_SELECT = {
-  id: true,
-  username: true,
-  email: true,
-  avatarConfig: true,
-  bgShape: true,
-  bgColor: true,
-} satisfies Prisma.UserDefaultArgs["select"];
 
 async function requireWorkspaceOwner(workspaceId: string, userId: string) {
   const prisma = await getPrisma();
@@ -51,7 +42,7 @@ export const listWorkspacesFn = createServerFn({ method: "GET" }).handler(
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     return prisma.workspace.findMany({
       where: { ownerId: userId },
@@ -77,7 +68,7 @@ export const listWorkspacesBriefFn = createServerFn({ method: "GET" }).handler(
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     return prisma.workspace.findMany({
       where: { ownerId: userId },
@@ -92,7 +83,7 @@ export const listPinnedWorkspacesBriefFn = createServerFn({ method: "GET" }).han
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     return prisma.workspace.findMany({
       where: { ownerId: userId, pinnedToSidebar: true },
@@ -113,7 +104,7 @@ export const toggleWorkspacePinFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireWorkspaceOwner(data.workspaceId, userId);
 
     await prisma.workspace.update({
@@ -135,7 +126,7 @@ export const createWorkspaceFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
 
     await requireResource(request, "workspaces", 1);
 
@@ -174,7 +165,7 @@ export const getWorkspaceDetailFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireWorkspaceOwner(data.workspaceId, userId);
 
     const workspace = await prisma.workspace.findUnique({
@@ -201,7 +192,7 @@ export const listWorkspaceProjectsFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireWorkspaceOwner(data.workspaceId, userId);
 
     return prisma.project.findMany({
@@ -236,7 +227,7 @@ export const updateWorkspaceFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireWorkspaceOwner(data.workspaceId, userId);
 
     const { workspaceId, ...rest } = data;
@@ -261,7 +252,7 @@ export const deleteWorkspaceFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireWorkspaceOwner(data.workspaceId, userId);
 
     const projectCount = await prisma.project.count({
@@ -283,18 +274,21 @@ export const deleteWorkspaceFn = createServerFn({ method: "POST" })
     }
 
     // 清空模式下需求（stories）的处理与删除项目逻辑保持一致：
-    // transfer → 迁移到用户「独立需求」内置项目；clear → 直接删除
-    if (projectCount > 0 && mode === "clear" && (data.storyMode ?? "transfer") === "transfer") {
-      const storyIds = (
-        await prisma.story.findMany({
-          where: { project: { workspaceId: data.workspaceId } },
-          select: { id: true },
-        })
-      ).map((s) => s.id);
-      await migrateStoriesToIndependentProject(userId, storyIds);
-    }
-
+    // transfer → 迁移到用户「独立需求」内置项目；clear → 直接删除。
+    // 迁移与下方删除同事务执行（审计 🟡：此前迁移在事务外，迁移成功而后续
+    // 事务失败会留下「需求已迁走、空间未删」的半迁移状态且不可回滚；
+    // migrateStoriesToIndependentProject 已支持 tx 参数——deleteProjectFn 先例）
     await prisma.$transaction(async (tx) => {
+      if (projectCount > 0 && mode === "clear" && (data.storyMode ?? "transfer") === "transfer") {
+        const storyIds = (
+          await tx.story.findMany({
+            where: { project: { workspaceId: data.workspaceId } },
+            select: { id: true },
+          })
+        ).map((s) => s.id);
+        await migrateStoriesToIndependentProject(userId, storyIds, tx);
+      }
+
       if (projectCount > 0) {
         if (mode === "clear") {
           // Story 对 project 为 Restrict 外键，storyMode=transfer 时需求已迁走，此处兜底清空残留
@@ -362,7 +356,7 @@ export const listWorkspaceActivitiesFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireWorkspaceOwner(data.workspaceId, userId);
 
     const projects = await prisma.project.findMany({
@@ -404,7 +398,7 @@ export const getWorkspaceActivityDataFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireWorkspaceOwner(data.workspaceId, userId);
 
     const projects = await prisma.project.findMany({
@@ -426,12 +420,17 @@ export const getWorkspaceActivityDataFn = createServerFn({ method: "GET" })
       dateMap.set(key, 0);
     }
 
+    // 防御性 take 上限（审计 ⚪：活跃空间 12 个月活动可达数万行，全量拉内存仅
+    // 为 JS 侧按日计数；SQL date_trunc 按用户任意时区表达式聚合有注入面/无效
+    // 时区报错风险，故先以行数上限兜底，DB 侧聚合为后续增强点）
+    const ACTIVITY_DATA_MAX_ROWS = 50_000;
     const activities = await prisma.projectActivity.findMany({
       where: {
         projectId: { in: projectIds },
         createdAt: { gte: rangeStart, lte: monthEnd },
       },
       select: { createdAt: true },
+      take: ACTIVITY_DATA_MAX_ROWS,
     });
 
     for (const a of activities) {
@@ -459,7 +458,7 @@ export const listWorkspaceMembersFn = createServerFn({ method: "GET" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const userId = session.user!.id!;
+    const userId = session.user.id;
     await requireWorkspaceOwner(data.workspaceId, userId);
 
     const [members, owner] = await Promise.all([
@@ -477,7 +476,9 @@ export const listWorkspaceMembersFn = createServerFn({ method: "GET" })
       }),
       prisma.workspace.findUnique({
         where: { id: data.workspaceId },
-        select: { ownerId: true, owner: { select: USER_BRIEF_SELECT } },
+        // createdAt 作 owner joinedAt（审计 ⚪：合成 new Date() 每次请求漂移，
+        // 前端展示会跳动）
+        select: { ownerId: true, createdAt: true, owner: { select: USER_BRIEF_SELECT } },
       }),
     ]);
 
@@ -487,12 +488,14 @@ export const listWorkspaceMembersFn = createServerFn({ method: "GET" })
           userId: owner.ownerId,
           role: "owner",
           status: "active",
-          joinedAt: new Date(),
+          joinedAt: owner.createdAt,
           user: owner.owner,
         }
       : null;
 
-    return [ownerMember, ...members.filter((m) => m.userId !== owner?.ownerId)].filter(Boolean);
+    return [ownerMember, ...members.filter((m) => m.userId !== owner?.ownerId)].filter(
+      (m): m is NonNullable<typeof m> => m !== null,
+    );
   });
 
 const addWorkspaceMemberSchema = z.object({
@@ -507,7 +510,7 @@ export const addWorkspaceMemberFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const currentUserId = session.user!.id!;
+    const currentUserId = session.user.id;
     await requireWorkspaceOwner(data.workspaceId, currentUserId);
 
     const workspace = await prisma.workspace.findUnique({
@@ -554,7 +557,7 @@ export const removeWorkspaceMemberFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    const currentUserId = session.user!.id!;
+    const currentUserId = session.user.id;
     await requireWorkspaceOwner(data.workspaceId, currentUserId);
 
     if (data.userId === (await prisma.workspace.findUnique({

package/src/server/serverFns/ws.ts

@@ -32,7 +32,7 @@ export const wsStreamFn = createServerFn({ method: 'GET' })
     if (!data.ids.length) throw new Error('Missing ids parameter')
     return {
       message: 'SSE stream endpoint',
-      userId: session.user!.id!,
+      userId: session.user.id,
       entityIds: data.ids,
     }
   })