@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/middlewares/__tests__/auth-context.test.ts

@@ -0,0 +1,156 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+// auth-context middleware 内部经 getRequest() 取请求 → requireAuth(request) 解 session。
+// 本测试 mock 请求入口（getRequest）与 session 底座（getCurrentSession / desktop-guest），
+// 让「真实 requireAuth 链」在受控输入下运行——requireAuth 本身不 mock，
+// 以此锁定 middleware 与旧 handler 内联鉴权走同一获取链。
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: vi.fn(),
+}))
+
+vi.mock('@/lib/session', () => ({
+  getCurrentSession: vi.fn(),
+}))
+
+vi.mock('@/server/desktop-guest', () => ({
+  isDesktopServer: vi.fn(() => false),
+  buildGuestSession: vi.fn(() => ({
+    user: { id: 'local-guest', email: 'guest@localhost', isGuest: true },
+  })),
+}))
+
+import { getRequest } from '@tanstack/react-start/server'
+import { getCurrentSession } from '@/lib/session'
+import { isDesktopServer } from '@/server/desktop-guest'
+import { requireAuth, UnauthorizedError } from '@/server/auth-helpers'
+import { authContextMiddleware } from '../auth-context'
+
+/** 直调 middleware 的 server 段（框架 executeMiddleware 的最小等价调用）。 */
+async function runAuthContextMiddleware(initialContext: Record<string, unknown> = {}) {
+  const serverFn = (authContextMiddleware as { options: { server?: Function } }).options.server
+  if (!serverFn) throw new Error('authContextMiddleware 未定义 .server() 段')
+  let merged: Record<string, unknown> = { ...initialContext }
+  return await (serverFn as any)({
+    data: undefined,
+    context: merged,
+    method: 'GET' as const,
+    serverFnMeta: {},
+    signal: new AbortController().signal,
+    next: async (inner?: { context?: Record<string, unknown> }) => {
+      // 与框架 callNextMiddleware 一致：next 的 context 增量并入调用方 context
+      merged = { ...merged, ...(inner?.context ?? {}) }
+      return { context: merged }
+    },
+  })
+}
+
+const FAKE_REQUEST = new Request('http://localhost:3000/_serverFn/x')
+
+const DB_USER = {
+  id: 'u1',
+  email: 'u1@test.com',
+  name: '用户一',
+  role: 'USER',
+}
+
+describe('authContextMiddleware（function middleware 注入 context.user）', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(getRequest).mockReturnValue(FAKE_REQUEST)
+    vi.mocked(isDesktopServer).mockReturnValue(false)
+  })
+
+  it('① 无 session：抛出与旧 requireAuth() 完全同型的 UnauthorizedError（name/message/constructor 逐字段一致）', async () => {
+    vi.mocked(getCurrentSession).mockResolvedValue(null)
+
+    // 基准：同一输入下旧 requireAuth 的抛错形状
+    let baseline: unknown
+    try {
+      await requireAuth(FAKE_REQUEST)
+    } catch (e) {
+      baseline = e
+    }
+    expect(baseline).toBeInstanceOf(UnauthorizedError)
+    const base = baseline as UnauthorizedError
+
+    let caught: unknown
+    try {
+      await runAuthContextMiddleware()
+    } catch (e) {
+      caught = e
+    }
+    expect(caught).toBeInstanceOf(UnauthorizedError)
+    const err = caught as UnauthorizedError
+    expect(err.name).toBe('UnauthorizedError')
+    expect(err.message).toBe('UNAUTHORIZED')
+    // 同型判定：与旧 requireAuth 抛错逐字段一致（客户端 401 处理依赖此形状）
+    expect(err.constructor).toBe(base.constructor)
+    expect(err.name).toBe(base.name)
+    expect(err.message).toBe(base.message)
+  })
+
+  it('①b 无 session：鉴权请求来自 getRequest()（与旧 handler 内联取法同源）', async () => {
+    vi.mocked(getCurrentSession).mockResolvedValue(null)
+    await expect(runAuthContextMiddleware()).rejects.toBeInstanceOf(UnauthorizedError)
+    expect(getRequest).toHaveBeenCalledTimes(1)
+    // requireAuth 收到的 request 与 getRequest() 返回值同源
+    expect(getCurrentSession).toHaveBeenCalledWith(FAKE_REQUEST)
+  })
+
+  it('② 有 session：context.user 为 DB 用户对象（requireAuth 返回的同一引用）', async () => {
+    vi.mocked(getCurrentSession).mockResolvedValue({
+      user: DB_USER,
+    } as never)
+
+    const result = await runAuthContextMiddleware()
+    expect(result.context).toBeDefined()
+    expect(result.context.user).toBe(DB_USER)
+    expect(result.context.user.id).toBe('u1')
+  })
+
+  it('②b desktop guest 降级语义保持：DEPLOY_TARGET=desktop 时匿名请求注入共享 guest 用户', async () => {
+    vi.mocked(getCurrentSession).mockResolvedValue(null)
+    vi.mocked(isDesktopServer).mockReturnValue(true)
+
+    const result = await runAuthContextMiddleware()
+    expect(result.context.user.id).toBe('local-guest')
+    expect(result.context.user.isGuest).toBe(true)
+  })
+
+  it('③ session 校验用户存在防线不变：session.user 为空（session callback getCachedProfile 拒绝的下游形态）→ 抛 UnauthorizedError', async () => {
+    // session callback 用户存在性校验失败时，session.user 为 null/缺失 id——
+    // middleware 必须与旧 requireAuth 一样拒绝该 session，而非注入无 id 的 user
+    vi.mocked(getCurrentSession).mockResolvedValue({ user: null } as never)
+
+    await expect(runAuthContextMiddleware()).rejects.toBeInstanceOf(UnauthorizedError)
+
+    // user 存在但缺 id（JWT 无 id 字段）同样拒绝
+    vi.mocked(getCurrentSession).mockResolvedValue({ user: { email: 'x@test.com' } } as never)
+    await expect(runAuthContextMiddleware()).rejects.toBeInstanceOf(UnauthorizedError)
+  })
+
+  it('③b 既有 context 增量保留：middleware 注入 user 不覆盖调用方已有 context 字段', async () => {
+    vi.mocked(getCurrentSession).mockResolvedValue({ user: DB_USER } as never)
+
+    const result = await runAuthContextMiddleware({ requestId: 'ctx-1' })
+    expect(result.context.requestId).toBe('ctx-1')
+    expect(result.context.user).toBe(DB_USER)
+  })
+})

package/src/server/middlewares/auth-context.ts

@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createMiddleware } from '@tanstack/react-start'
+import { getRequest } from '@tanstack/react-start/server'
+import { requireAuth } from '@/server/auth-helpers'
+import type { AuthedSession } from '@/server/auth-helpers'
+
+/**
+ * context.user 的注入类型：与 requireAuth 成功返回的 session.user 同型
+ * （SessionUser & { id: string }，消费方免非空断言）。
+ */
+export type AuthedContextUser = AuthedSession['user']
+
+/**
+ * function middleware 注入的 context 增量形状（per-fn `.middleware()` 挂载后，
+ * handler 的 `context` 参数自动获得本类型）。
+ */
+export interface AuthedContext {
+  user: AuthedContextUser
+}
+
+/**
+ * serverFn 鉴权 context 注入 middleware（TanStack 优化计划任务 6，team 域试点）。
+ *
+ * 复核结论（@tanstack/react-start@1.169.4 / start-client-core@1.170.39，.d.ts 实证）：
+ * - per-fn `.middleware()` 是本基建采用的唯一挂载路径：`createServerFn(...).middleware([mw])`
+ *   （createServerFn.d.ts ServerFnMiddleware），middleware 的 `.server()` 产出 context 经
+ *   `AssignAllServerFnContext` 自动流入 handler 的 `context` 类型（ServerFnCtx），
+ *   无需 `declare module` augmentation。
+ * - 全局挂载点在本版本实际存在（StartInstanceOptions.functionMiddleware 声明 +
+ *   createServerFn.js 运行时把 getStartOptions().functionMiddleware 拼进执行链），
+ *   但不用：① 全局路径的类型注入依赖 Register.config augmentation（app 的 Register
+ *   仅 augment 了 router）；② 全局注入会对全部 serverFn（含邀请 token 查询、bug 上报
+ *   等 ~600 个公开/免鉴权端点）跑鉴权查询，改变公开端点行为与性能。T7 CI 守护按
+ *   per-fn 存在性检查配套。
+ * - 错误同型：middleware 抛错与 handler 内抛错走同一条 RPC 错误序列化路径
+ *   （handleServerAction 同一 try/catch → createServerFnErrorResponse），故本 middleware
+ *   内部直接复用 `requireAuth(getRequest())` 旧链，UnauthorizedError 形状零变化
+ *   （客户端 401 处理依赖）。资源属主校验（assertOwned 等）不在此层，仍在各 handler。
+ */
+export const authContextMiddleware = createMiddleware({ type: 'function' }).server<AuthedContext>(
+  async ({ next }) => {
+    const request = getRequest()
+    const session = await requireAuth(request)
+    return next({ context: { user: session.user } })
+  },
+)

package/src/server/remote-auth.ts

@@ -1,5 +1,11 @@
-// DESKTOP-LEGACY（迁移 P1 标记，勿删勿改）：Tauri 时代的桌面远端会话读取桥，
-// Electron 壳（P2）将以 preload desktopBridge 等价实现替代后整链移除。
+// 桌面远端会话持久层（Electron）：读写 Electron 宿主注入的
+// DESKTOP_USER_DATA_DIR 下的 remote-auth.json（main.ts 集中注入 env，
+// backend serverFn 进程内 fs 直达，无 IPC）。Tauri invoke 实现已随
+// Tauri 2 → Electron 迁移清除（2026-10-31）；云/Web 部署（DEPLOY_TARGET
+// 非 desktop）恒 null / no-op，行为与旧版一致。
+import { promises as fs } from "node:fs"
+import path from "node:path"
+
 export interface RemoteAuthData {
   userId: string
   planName: string
@@ -16,23 +22,61 @@ export interface RemoteAuthData {
   bgColor?: string
 }
 
-export async function readRemoteAuth(): Promise<RemoteAuthData | null> {
-  if (process.env.DEPLOY_TARGET !== 'desktop') return null
+/** 磁盘形态：auth（登录 token）与 session（exchange 后的会话态）分次写入、合并读取 */
+interface RemoteAuthFile {
+  token?: string
+  sessionToken?: string
+  session?: {
+    userId: string
+    planName: string
+    sessionToken?: string
+  }
+}
+
+function filePath(): string | null {
+  const dir = process.env.DESKTOP_USER_DATA_DIR
+  if (!dir) return null
+  return path.join(dir, "remote-auth.json")
+}
+
+async function readFile(): Promise<RemoteAuthFile | null> {
+  const file = filePath()
+  if (!file) return null
   try {
-    const { invoke } = await import('@tauri-apps/api/core')
-    return (await invoke<RemoteAuthData | null>('read_remote_auth')) ?? null
+    return JSON.parse(await fs.readFile(file, "utf8")) as RemoteAuthFile
   } catch {
+    // 文件不存在/损坏均视为未登录（损坏文件在下次写入时被覆盖自愈）
     return null
   }
 }
 
-// 写入防御（2026-10 审计 🟢：原 invoke 无 try/catch，rejection 完全依赖调用方兜底，
-// 与 readRemoteAuth 的防御风格不一致——本地持久化失败不应反噬登录/登出主流程）
+async function writeFile(next: RemoteAuthFile): Promise<void> {
+  const file = filePath()
+  if (!file) return
+  const tmp = `${file}.tmp`
+  // 0600：文件含云会话 token（敏感），限属主读写；tmp+rename 原子替换防半写
+  await fs.writeFile(tmp, JSON.stringify(next, null, 2), { mode: 0o600 })
+  await fs.rename(tmp, file)
+}
+
+export async function readRemoteAuth(): Promise<RemoteAuthData | null> {
+  if (process.env.DEPLOY_TARGET !== 'desktop') return null
+  const data = await readFile()
+  if (!data?.session?.userId) return null
+  return {
+    userId: data.session.userId,
+    planName: data.session.planName,
+    features: {},
+    sessionToken: data.session.sessionToken ?? data.sessionToken,
+  }
+}
+
+// 写入防御（2026-10 审计 🟢）：本地持久化失败不应反噬登录/登出主流程
 export async function writeRemoteAuth(token: string, sessionToken?: string): Promise<void> {
   if (process.env.DEPLOY_TARGET !== 'desktop') return
-  const { invoke } = await import('@tauri-apps/api/core')
   try {
-    await invoke('write_remote_auth', { token, sessionToken })
+    const prev = (await readFile()) ?? {}
+    await writeFile({ ...prev, token, sessionToken })
   } catch (e) {
     console.warn('[remote-auth] write_remote_auth 失败（本地权益态未更新）:', e instanceof Error ? e.message : String(e))
   }
@@ -44,9 +88,9 @@ export async function writeRemoteSession(
   sessionToken?: string,
 ): Promise<void> {
   if (process.env.DEPLOY_TARGET !== 'desktop') return
-  const { invoke } = await import('@tauri-apps/api/core')
   try {
-    await invoke('write_remote_session', { userId, planName, sessionToken })
+    const prev = (await readFile()) ?? {}
+    await writeFile({ ...prev, session: { userId, planName, sessionToken } })
   } catch (e) {
     console.warn('[remote-auth] write_remote_session 失败（本地会话态未更新）:', e instanceof Error ? e.message : String(e))
   }
@@ -54,27 +98,10 @@ export async function writeRemoteSession(
 
 export async function clearRemoteAuth(): Promise<void> {
   if (process.env.DEPLOY_TARGET !== 'desktop') return
-  const { invoke } = await import('@tauri-apps/api/core')
   try {
-    await invoke('clear_remote_auth')
+    const file = filePath()
+    if (file) await fs.rm(file, { force: true })
   } catch (e) {
     console.warn('[remote-auth] clear_remote_auth 失败（本地态可能残留）:', e instanceof Error ? e.message : String(e))
   }
 }
-
-export async function openLoginUrl(loginUrl: string): Promise<void> {
-  if (process.env.DEPLOY_TARGET !== 'desktop') {
-    if (typeof window !== 'undefined') {
-      window.open(
-        loginUrl.startsWith('/')
-          ? `${window.location.origin}${loginUrl}`
-          : loginUrl,
-        '_blank',
-        'noopener,noreferrer',
-      )
-    }
-    return
-  }
-  const { invoke } = await import('@tauri-apps/api/core')
-  await invoke('open_login_url', { url: loginUrl })
-}

package/src/server/serverFns/__tests__/ai-hosted-models.test.ts

@@ -2,17 +2,50 @@
 import { describe, expect, it, vi, beforeEach } from 'vitest'
 
 // ① createServerFn chain builder mock（与 ai-source-mode.test.ts 相同）
-vi.mock('@tanstack/react-start', () => {
-  const createServerFn = () => {
+vi.mock('@tanstack/react-start', () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
     const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
       handler(fn: Function) {
-        return async (args: { data: unknown }) => fn(args)
+        return async (args: { data: unknown }) => {
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data: args?.data,
+              context,
+              method: 'GET',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
+          }
+          return fn({ ...args, context })
+        }
       },
     }
     return api
-  }
-  return { createServerFn }
-})
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
+}))
 vi.mock('@tanstack/react-start/server', () => ({
   getRequest: () => ({}),
 }))
@@ -22,20 +55,19 @@ const mocks = vi.hoisted(() => ({
   currentSession: vi.fn(),
 }))
 
-vi.mock('@allbluecn/kernel', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('@allbluecn/kernel')>()
+// 迁移后 requireAuth 消费入口：authContextMiddleware 内部调用
+vi.mock('@/server/auth-helpers', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/server/auth-helpers')>()
   const UnauthorizedError = class UnauthorizedError extends Error {
     constructor(message = 'UNAUTHORIZED') { super(message); this.name = 'UnauthorizedError' }
   }
   return {
     ...actual,
-    getServerSeam: () => ({
-      requireAuth: async () => {
-        const session = await mocks.currentSession()
-        if (!session?.user?.id) throw new UnauthorizedError()
-        return session
-      },
-    }),
+    requireAuth: async () => {
+      const session = await mocks.currentSession()
+      if (!session?.user?.id) throw new UnauthorizedError()
+      return session
+    },
   }
 })
 

package/src/server/serverFns/__tests__/ai-source-mode.test.ts

@@ -2,9 +2,17 @@
 import { describe, expect, it, vi, beforeEach } from 'vitest'
 
 // ① createServerFn chain builder mock（照抄 workspace-kb-idor.test.ts:25-45）
-vi.mock('@tanstack/react-start', () => {
-  const createServerFn = () => {
+vi.mock('@tanstack/react-start', () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: () => {
     const api: any = {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
       validator(schema: { parse: (d: unknown) => unknown }) {
         api._validator = schema
         return api
@@ -15,14 +23,37 @@ vi.mock('@tanstack/react-start', () => {
           if (api._validator && data !== undefined) {
             data = api._validator.parse ? api._validator.parse(data) : data
           }
-          return fn({ data })
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
+          }
+          return fn({ data, context })
         }
       },
     }
     return api
-  }
-  return { createServerFn }
-})
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
+  },
+}))
 vi.mock('@tanstack/react-start/server', () => ({
   getRequest: () => ({}),
 }))
@@ -32,20 +63,19 @@ const mocks = vi.hoisted(() => ({
   currentSession: vi.fn(),
 }))
 
-vi.mock('@allbluecn/kernel', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('@allbluecn/kernel')>()
+// 迁移后 requireAuth 消费入口：authContextMiddleware 内部调用
+vi.mock('@/server/auth-helpers', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/server/auth-helpers')>()
   const UnauthorizedError = class UnauthorizedError extends Error {
     constructor(message = 'UNAUTHORIZED') { super(message); this.name = 'UnauthorizedError' }
   }
   return {
     ...actual,
-    getServerSeam: () => ({
-      requireAuth: async () => {
-        const session = await mocks.currentSession()
-        if (!session?.user?.id) throw new UnauthorizedError()
-        return session
-      },
-    }),
+    requireAuth: async () => {
+      const session = await mocks.currentSession()
+      if (!session?.user?.id) throw new UnauthorizedError()
+      return session
+    },
   }
 })
 

package/src/server/serverFns/__tests__/billing.test.ts

@@ -46,11 +46,16 @@ vi.mock("@tanstack/react-start", () => ({
   createServerFn: () => {
     const api = {
       _validator: undefined as unknown,
+      _middlewares: [] as unknown[],
+      middleware(mws: unknown[]) {
+        this._middlewares.push(...mws);
+        return this;
+      },
       validator(schema: unknown) {
         this._validator = schema;
         return this;
       },
-      handler(fn: (p: { data: unknown }) => Promise<unknown>) {
+      handler(fn: (p: { data: unknown; context: unknown }) => Promise<unknown>) {
         const self = this;
         return async (args: { data?: unknown }) => {
           let data = args?.data;
@@ -58,12 +63,42 @@ vi.mock("@tanstack/react-start", () => ({
             const v = self._validator as { parse?: (d: unknown) => unknown };
             data = v.parse ? v.parse(data) : data;
           }
-          return fn({ data });
+          // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+          // 依序执行 middleware 的 server 段，真实鉴权链由被 mock 的 auth-helpers 承接
+          let context: unknown = {};
+          for (const mw of self._middlewares) {
+            const serverFn = (mw as { options?: { server?: unknown } })?.options?.server;
+            if (typeof serverFn !== "function") continue;
+            const result = await (
+              serverFn as (p: unknown) => Promise<{ context?: unknown }>
+            )({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: (inner: { context?: unknown } | undefined) =>
+                Promise.resolve({ context: { ...(context as object), ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
+          }
+          return fn({ data, context });
         };
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状，
+  // 供上方 handler 包装器执行 server 段注入 context.user
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));

package/src/server/serverFns/__tests__/collab-snapshot.test.ts

@@ -28,7 +28,6 @@ import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import * as Y from "yjs";
-import type { ZodType } from "zod";
 
 const mocks = vi.hoisted(() => ({
   requireAuth: vi.fn(),
@@ -43,30 +42,58 @@ const mocks = vi.hoisted(() => ({
 }));
 
 vi.mock("@tanstack/react-start", () => ({
-  createServerFn: (_config: unknown) => {
-    const api: {
-      _validator?: ZodType;
-      validator: (schema: ZodType) => unknown;
-      handler: (fn: (args: { data: unknown }) => unknown) => unknown;
-    } = {
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
+  createServerFn: (config: any) => {
+    const api: any = {
       _validator: undefined,
-      validator(schema: ZodType) {
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws);
+        return api;
+      },
+      validator(schema: any) {
         this._validator = schema;
         return this;
       },
-      handler(fn: (args: { data: unknown }) => unknown) {
-        const validator = this._validator;
-        return async (args: { data?: unknown }) => {
+      handler(fn: Function) {
+        const wrapped = async (args: any) => {
           let data = args?.data;
-          if (validator && data !== undefined) {
-            data = validator.parse(data);
+          if (api._validator && data !== undefined) {
+            data = api._validator.parse ? api._validator.parse(data) : data;
+          }
+          let context: any = {};
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server;
+            if (!serverFn) continue;
+            const result = await serverFn({
+              data,
+              context,
+              method: "POST",
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            });
+            context = result.context;
           }
-          return fn({ data });
+          return fn({ data, context });
         };
+        return wrapped;
       },
     };
     return api;
   },
+  // auth-context.ts 依赖 createMiddleware({ type: "function" }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } };
+    mw.server = (fn: Function) => {
+      mw.options.server = fn;
+      return mw;
+    };
+    return mw;
+  },
 }));
 
 vi.mock("@tanstack/react-start/server", () => ({